Post #4393362

SMOKE#SCREEN disables Windows Defender, then installs a validly signed ScreenConnect agent as its backdoor. Your signature allowlist trusts it. The tampering it does first is what gives it away. https://suriq.io/blog/smokescreen-screenconnect-rmm-defender-evasion #ThreatIntel #Detection #Phishing #Windows