--- title: "MSSQL to ScreenConnect" url: https://daily.dev/posts/mssql-to-screenconnect-mshm1pmc4 source_url: https://www.huntress.com/blog/mssql-to-screenconnect type: article source: "Huntress Blog" published: 2026-05-31T07:42:59.338Z updated: 2026-05-31T08:08:36.002Z tags: ["powershell"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MSSQL to ScreenConnect **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 5 min read · 0 upvotes · 0 comments ## Summary Huntress SOC analysts investigated a series of attacks targeting endpoints running MSSQL Server as part of Fortinet Enterprise Management Server (EMS) installations. The threat actor exploited xp_cmdshell to execute commands, used finger.exe for C2 communication (IP 185.56.83.82, previously seen in other incidents), and attempted to install a ConnectWise ScreenConnect remote access instance via obfuscated PowerShell download cradles. The attack sequence appeared automated and scripted, running nearly identically across multiple customer endpoints. Notably, the attacker attempted to run msiexec against an MSI file not yet downloaded, suggesting a flawed playbook. On all monitored endpoints, the ScreenConnect installation failed. IoCs include two C2 IPs and a ScreenConnect instance ID, with MITRE ATT&CK mappings covering initial access via public-facing application exploit, PowerShell/cmd execution, msiexec and command obfuscation for defense evasion, and remote access software for C2. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [How a single ScreenConnect incident exposed a massive campaign](https://daily.dev/posts/how-a-single-screenconnect-incident-exposed-a-massive-campaign-hxzs54kdz) · Securelist · 0 upvotes · 0 comments --- Tags: [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/mssql-to-screenconnect-mshm1pmc4)