Watch it run: hunting ScreenConnect abuse with Claude Code

One signed client got the attacker in, the other one stayed. KQL and ES|QL on real lab telemetry.

If you read the ScreenConnect investigation, you saw how one signed client got the attacker in and a second called a server they controlled.

For this video I hunted both again, with Claude Code running part of the hunt and every row checked by hand.

What the video adds:

1. The Claude Code workflow across archived Defender telemetry in ADX (KQL) and Elastic (ES|QL), with the manual checks marked.

2. Both ScreenConnect client folders on disk, viewed from a snapshot booted offline.

3. Counting both ScreenConnect services and comparing their relays, so removing the first client doesn’t leave the second behind. Multiple instances still need context.

The eight steps in the video: Claude Code drives three, I investigate the relays and operator activity by hand, and we count the services together.