Reviewed the S1 alert and confirmed this was our Screen Connect Client. Checked the machine backstage and the only RMM agents on the machine are from Atlantic. Marking as a false positive and adding to the exclusions. No further action required. Closing ticket.
Reviewed the S1 alert and confirmed this was our Screen Connect Client. Checked the machine backstage and the only RMM agents on the machine are from Atlantic. Marking as a false positive and adding to the exclusions. No further action required. Closing ticket.
A suspicious software file was detected and automatically removed on a laptop used by the user Miranda; the event was rated high severity because the file was determined malicious by security controls. The device is a company-managed laptop and the threat has been mitigated successfully. Business impact is limited given the rapid containment, though there is potential risk to data or operations if similar items run elsewhere.
SOC Response Actions Actions the SOC performed (or attempted). Follow this link for further information on Use Case #5 and Use Case #6. ActionStatus
--- --- 1810-LT-4FFCC5E, no full disk scan command was sent. Not Configured 1810-LT-4FFCC5E, endpoint was not isolated from the network. Not Configured
Recommended Remediation
[Containment] Isolate the affected endpoint '1810-LT-4FFCC5E' from the network (disconnect Wi‑Fi and unplug Ethernet) and keep the device powered on for forensic preservation.
[Eradication] Remove the quarantined file 'ScreenConnect.ClientSetup.exe' (sha256: da6461465247022bae455d548efc31ff5161147fec953643dd2bbf2af7a1a6d4) from the endpoint and ensure any related ScreenConnect installation paths (\Device\HarddiskVolume3\WINDOWS\SystemTemp\ScreenConnect) are deleted.
[Eradication] Uninstall any unauthorized remote‑access software from the endpoint and revoke any certificates issued to 'CONNECTWISE, LLC' for this agent if found.
[Hardening] Reset local user credentials for 'Miranda' and any other local accounts on the device; enforce strong unique passwords and enable MFA where supported.
[Hardening] Ensure SentinelOne agent is up to date (current version reported 25.2.5.437) and confirm group/site policies for 'Stonehenge Advisors Inc - HQ' enforce automatic quarantine for revoked/suspicious executables.
da646146...f7a1a6d4 Malicious File hash detected by 31 security engines. Classified under the meaningful name /home/petik/ss/malware/2026-03-19_f07a87485bd2333bb7e91f26bd5b8700_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar. Hybrid-Analysis
da646146...f7a1a6d4 No Relevant Results No behavioral or reputation data returned for this hash at the time of analysis. Indicators of Compromise
