Security insights, response tips, platform updates.

SEO poisoning is a common malware delivery technique in which attackers exploit search engine results to trick users into downloading fake software installers. In this campaign, threat actors impersonated legitimate utility tools and used malicious installers to deploy ScreenConnect, establish remote access, create persistence, modify Microsoft Defender exclusions, and potentially deploy GPU mining tools. This blog demonstrates how Wazuh can detect behaviors associated with this attack on Windows endpoints using Sysmon process creation logs. The detection focuses on endpoint activity such as suspicious RuntimeHost.exe execution, scheduled task creation, silent msiexec.exe installation of a masqueraded DLL, Microsoft Defender exclusion changes, and suspicious ScreenConnect execution. Instead of relying solely on indicators of compromise such as domains, IP addresses, and file hashes, this detection approach uses behavior-based rules to provide stronger, longer-term coverage. The blog also includes safe attack emulation steps, expected Wazuh alerts, cleanup commands, and tuning recommendations for production environments where ScreenConnect may be legitimately used.