Claude Code-assisted ScreenConnect hunt: a KQL check for Backstage operator shells
Source Reddit ThreatIntel
Discussion
This report discusses a detection technique using Kusto Query Language (KQL) to hunt for Backstage operator shells spawned by ScreenConnect.WindowsBackstageShell.exe, a legitimate feature of ScreenConnect remote support software. The Backstage shell runs as SYSTEM under the client service and may be missed by hunts focusing only on cmd.exe or powershell.exe processes. Execution of this shell alone does not indicate malicious activity; correlation with approved support activity is necessary to identify abuse.
r/threatintel (opens in a new tab)u/securityinbits0 points0 comments
Claude Code helped with my ScreenConnect hunt; I investigated the operator's Backstage shell by hand.
Video: https://youtu.be/JBEj3hSuWng
In the lab, ScreenConnect.WindowsBackstageShell.exe ran as SYSTEM under the client service before the operator pushed a second installer. A hunt limited to cmd.exe or powershell.exe children would miss that shell.
This KQL hunt from my published case pack surfaces Backstage launches:
// The operator's hidden shell, spawned by the ScreenConnect service let lookback = 30d; DeviceProcessEvents | where Timestamp > ago(lookback) | where FileName =~ "ScreenConnect.WindowsBackstageShell.exe" | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, AccountName, ProcessCommandLine Correlate the parent service, account, relay and session timing with approved support activity. Backstage is a legitimate ScreenConnect feature; its execution alone does not prove abuse.
The video covers the wider KQL + ES|QL investigation. Queries are linked in its description.