Hi all,
We got a notification that a controlled application (ScreenConnect) was blocked on one of our servers. Is there anyway to identify the location of exe or application which caused this?
I used the Threat Analysis Service and searched for the process name using the contains attribute but nothing showed uo
Hello DavidGorman
If you have the XDR License, then you can use the "Windows Programs" query which is present in the Live Discover section. This query will share you the results of the installed applications used by the windows installer. You can give it a try and you may find the install locations of the ScreenConnect application from this query,
Best Regards,
Hello DavidGorman
If you have the XDR License, then you can use the "Windows Programs" query which is present in the Live Discover section. This query will share you the results of the installed applications used by the windows installer. You can give it a try and you may find the install locations of the ScreenConnect application from this query,
Best Regards,
