Microsoft has published a technical analysis of SCKit that gives defenders more specific ways to find persistence left by the ScreenConnect campaign. Its November 13 research follows DaySec’s earlier coverage of the affected endpoints and extension investigation.
The analysis describes a decoder that uses device-specific key material to unpack the toolkit. It also identifies scheduled tasks and a registry Run value named RelayTrapLiteAlert that keep components available after deployment.
Microsoft supplies Defender hunting queries for those artifacts, campaign infrastructure and temporary PowerShell files following the k<32-hex>.ps1 naming pattern. Such matches need investigation alongside approved administrative activity; a filename alone does not establish compromise.
Response needs to cover both customer endpoints and technician workstations. Microsoft warns that deleting an unauthorized ScreenConnect client leaves other persistence and exposed web sessions unresolved, and recommends investigating through a separate trusted channel.
The report explains how SCKit’s technician-targeting components are designed to spread. It does not establish a completed chain of infections through that mechanism.
