CHEAPUNO guide

How to check if my firewall blocks ScreenConnect phishing domains

Verify your security blocks known malicious domains and detects RMM payloads to stop persistent threats.

CHEAPUNO EditorialSources checked 7 10 月, 2026

Spotlight

PAGE: https://alison.com/course/fundamentals-of-power-query

PROMISE: Learn to reshape Power Query data structures to filter known domains and phishing markers in Excel.

WHO: Security analysts and compliance staff who use Excel to process and audit data logs.

WHYNOW: The course provides the specific data wrangling skills needed to handle complex security datasets today.

DESC: Up your efficiency when cleaning, altering, and rearranging your data by learning and applying the many incredible features of Power BI’s Power Query.

BEFORE: Manual checks of individual log files miss inconsistent domain spellings.

BEFORE: Merging data from different security sources is slow and error-prone.

BEFORE: Lack of visibility into how the data was cleaned makes the results hard to trust.

AFTER: Power Query steps automatically standardize and clean the domain names in the raw logs.

AFTER: The workflow merges all source datasets into a single view for easier pattern matching.

AFTER: The M code layer provides a clear, inspectable record of every transformation applied.

GAIN: Ability to manipulate and clean large datasets of security logs efficiently in Excel.

GAIN: Process for merging multiple data sources to get a complete view of potential threats.

GAIN: Understanding of M code to audit and modify the automated data cleaning logic.

STEP: Raw logs contain mixed formats, making it hard to isolate specific domain patterns. || Explain the process of manipulating data with Power Query in Excel || Apply transform steps to standardize the log entries before running domain blocklist filters.

STEP: Suspicious URLs are scattered across multiple files without a central view. || List the stages for merging several datasets from various systems || Combine the separate log files into one table to review all potential phishing vectors together.

STEP: The transformation logic needs to be verified or shared with the security team. || Define the concept of M code || Write and audit the underlying M formulas to ensure the cleaning rules are transparent and reusable.

STEP: The final report requires checking if the data preparation actually fixed the source issues. || Data Analysis || Review the summarized results to confirm that the known ScreenConnect and Power BI markers are correctly flagged.

NOTFOR: Users who need to configure network firewall rules or DNS blocking directly.

NOTFOR: Teams that do not have the data exported into Excel files for analysis.

FACT: Average duration: 1.5-3 Hours (Contains Video)

FACT: CPD-accredited certificate available

FACT: Advanced level

COVERS: Discuss the history of the Microsoft Excel Power Query tool

COVERS: Explain the process of manipulating data with Power Query in Excel

COVERS: Summarize the steps for wrangling data to solve various problems

COVERS: Define the concept of M code

COVERS: Indicate the process of locating the M code

COVERS: Outline the Power Query features and items

COVERS: List the stages for merging several datasets from various systems

COVERS: Describe how to change the sample file

COVERS: Summarize the process of combining data from other folders

COVERS: Data Analysis

COVERS: Microsoft

MODULE: Using Power Query || Introduction to Power Query | Manipulating Data | Tour of Power Query Items | File from Folder

What you are probably seeing

You see new, unknown external links in your email inbox that use Power BI branding to bypass your initial suspicion.

Your security dashboard flags low-level activity from remote management tools that your team does not typically use.

Why it happens

Attackers use legitimate business software like Power BI as a vector to deliver malicious remote access agents that are hard to spot.

The malware persists by leveraging trusted domains and remote management protocols that are often whitelisted by default in business environments.

What changed recently

Step by step

1. Audit your firewall logs for any outbound connections to ScreenConnect domains that are not on your approved list.

2. Review your email gateway rules to identify and block known phishing domains associated with recent Power BI campaigns.

3. Check your endpoint detection and response tools to ensure they can identify and block unexpected remote access payloads.

4. Create a specific blocklist for unapproved remote management software to prevent persistence after the initial infection.

5. Send a team alert to remind users to treat unsolicited remote access requests or document links with extreme caution.

Ways to go further

Start here: Basics of Power Query For when you are focusing on data transformation steps. Open the free course on Alison ↗

Better fit: Introduction to Analysis with Power BI Desktop For when you are learning the specific desktop application. Open the free course on Alison ↗

Best when: Diploma in Microsoft Power BI for Beginners For when you are a beginner needing structured fundamentals. Open the free course on Alison ↗

Affiliate links: CHEAPUNO may earn a commission if you buy through them, at no extra cost to you.