# FIXTURE_ONLY: test cases for check-screenconnect-extensions (want_rc|args|expected text). All inputs are synthetic.
1|--extensions-dir tests/fixtures/app_ext_hit|NAMED EXTENSION: input (extension 0a1b2c3d-0000-4000-8000-000000000001): Manifest name "RMM+" is one of the five 3rd party extensions ConnectWise disabled as a precaution
1|--extensions-dir tests/fixtures/app_ext_hit|Manifest name "Labtech Plus" is one of the five
1|--extensions-dir tests/fixtures/app_ext_hit|Manifest name "RMM+ Password Link" is one of the five
1|--extensions-dir tests/fixtures/app_ext_hit|REVIEW: input (extension 0a1b2c3d-0000-4000-8000-000000000005): POSSIBLE EXTENSION: Manifest name "RMM Plus Toolkit"
1|--extensions-dir tests/fixtures/app_ext_hit|UNKNOWN: input (extension 0a1b2c3d-0000-4000-8000-000000000006): no readable Manifest.xml
1|--extensions-dir tests/fixtures/app_ext_hit|UNKNOWN: input (extension 0a1b2c3d-0000-4000-8000-000000000007): Manifest.xml has no Name element
1|--extensions-dir tests/fixtures/app_ext_hit|REVIEW: input (App_Extensions/loose.ashx): LOOSE FILE
1|--extensions-dir tests/fixtures/app_ext_hit|NOTE: input (App_Extensions/not-a-guid): folder name is not a GUID
1|--extensions-dir tests/fixtures/app_ext_hit|installed extension "Example Report Tool" by "FIXTURE_ONLY Example ? Co".
1|--extensions-dir tests/fixtures/app_ext_hit|7 extension folders read: 3 named by ConnectWise, 1 possible, 2 unreadable, 1 loose files.
1|--extensions-dir tests/fixtures/app_ext_hit|RESULT: FINDINGS (3 findings, 2 review, 2 unknown)
1|--extensions-dir tests/fixtures/app_ext_bom|NAMED EXTENSION: input (extension 2a1b2c3d-0000-4000-8000-000000000001): Manifest name "RMM Plus"
1|--extensions-dir tests/fixtures/app_ext_bom|installed extension "Labtech Pl?s?pipe" by "FIXTURE_ONLY caf? ?x? ? ?".
0|--extensions-dir tests/fixtures/app_ext_clean|NO FINDINGS: input (App_Extensions): none of the five 3rd party extensions ConnectWise lists is installed in this folder.
0|--extensions-dir tests/fixtures/app_ext_clean|installed extension "Example Session Timer".
0|--extensions-dir tests/fixtures/app_ext_empty|0 extension folders read
1|--clients tests/fixtures/clients_mixed.txt|ROGUE CLIENT: input (client 2588ef5c15954b10): client ID 2588ef5c15954b10 is one of the rogue ScreenConnect client IDs in the BleepingComputer report.
1|--clients tests/fixtures/clients_mixed.txt|ROGUE CLIENT: input (client ed630cc2c873b091)
1|--clients tests/fixtures/clients_mixed.txt|IOC HOST: input (client ed630cc2c873b091): the service line references soxnewwork[.]homedns[.]org
1|--clients tests/fixtures/clients_mixed.txt|IOC HOST: input (client 00112233aabbccdd): the service line references sc[.]payproofkit[.]com
1|--clients tests/fixtures/clients_mixed.txt|EXPLOITED TAG: input (client 2588ef5c15954b10): c=Exploited7 matches the installer pattern &c=Exploited<N> in the BleepingComputer report.
1|--clients tests/fixtures/clients_mixed.txt|EXPLOITED TAG: input (client 00112233aabbccdd): c=exploited12
1|--clients tests/fixtures/clients_mixed.txt|UNKNOWN: input (client fedcba9876543210): no h= relay host in this line
1|--clients tests/fixtures/clients_mixed.txt|points at h=other-msp.example.com p=8041 (no --expected-host given, so not compared; k= and other keys not printed).
1|--clients tests/fixtures/clients_mixed.txt|RESULT: FINDINGS (6 findings, 0 review, 1 unknown)
1|--clients tests/fixtures/clients_mixed.txt --expected-host instance-fx01-relay.example.com|REVIEW: input (client 99887766554433aa): UNEXPECTED HOST: points at h=other-msp.example.com p=8041, which is not in --expected-host.
1|--clients tests/fixtures/clients_mixed.txt --expected-host instance-fx01-relay.example.com|NOTE: input (client 0123456789abcdef): points at h=instance-fx01-relay.example.com p=443, which is in --expected-host
1|--clients tests/fixtures/clients_mixed.txt --expected-host instance-fx01-relay.example.com|RESULT: FINDINGS (6 findings, 4 review, 1 unknown)
5|--clients tests/fixtures/clients_clean.txt --expected-host other.example.com|UNEXPECTED HOST: points at h=Instance-FX01-Relay.example.com p=443
0|--clients tests/fixtures/clients_clean.txt --expected-host INSTANCE-fx01-relay.example.com|NO FINDINGS: input (clients file): no rogue client ID, IOC host or Exploited tag from the BleepingComputer report, and every client points at an expected host.
0|--clients tests/fixtures/clients_clean.txt|NO FINDINGS: input (clients file): no rogue client ID, IOC host or Exploited tag from the BleepingComputer report.
3|--clients tests/fixtures/clients_empty.txt|UNKNOWN: input (clients file): no client lines in the export.
1|--clients tests/fixtures/clients_bom_crlf.txt|IOC HOST: input (client 1111222233334444): the service line references cdn007-digitaldownloads[.]com
1|--clients tests/fixtures/clients_bom_crlf.txt|points at h=cdn007-digitaldownloads.com p=443 (no --expected-host
1|--files-root tests/fixtures/files_hit|NAMED FILE: input (file ProgramData/fx/PANEL-LATERAL.ps1)
1|--files-root tests/fixtures/files_hit|NAMED FILE: input (file Users/fx/AppData/Local/Temp/runnew.cmd)
1|--files-root tests/fixtures/files_hit|NAMED FILE: input (file Windows/Temp/ScreenConnect/ToolboxRelayUploader.exe)
1|--files-root tests/fixtures/files_hit|RESULT: FINDINGS (3 findings, 0 review, 0 unknown)
0|--files-root tests/fixtures/files_clean|NO FINDINGS: input (files under tests/fixtures/files_clean)
0|--extensions-dir tests/fixtures/app_ext_clean --clients tests/fixtures/clients_clean.txt --files-root tests/fixtures/files_clean --expected-host instance-fx01-relay.example.com --name fx-site-01|RESULT: NO FINDINGS (0 findings, 0 review, 0 unknown)
1|--extensions-dir tests/fixtures/app_ext_hit --files-root tests/fixtures/files_clean --name fx-site-02|NOTE: fx-site-02: ConnectWise advises investigating suspected compromise with separate security tooling
1|--clients tests/fixtures/clients_mixed.txt|IOC SOURCE: rogue client IDs, hosts, the Exploited tag and file names come from the BleepingComputer report (11 Nov 2026 22:56 UTC) citing security researchers; ConnectWise has not published IOCs.
0|--clients tests/fixtures/clients_clean.txt|ADVISORY (ConnectWise, published 11 Nov 2026 22:45 UTC, status: Cause and scope under investigation)
4||Usage:
4|--bogus x|Usage:
4|--name|Usage:
4|--clients tests/fixtures/clients_clean.txt --clients tests/fixtures/clients_empty.txt|Usage:
4|--files-root tests/fixtures/files_clean --expected-host a.example.com|ERROR: --expected-host needs --clients
4|--clients tests/fixtures/clients_clean.txt --expected-host bad_host|ERROR: --expected-host takes host names or IPv4 addresses
4|--clients tests/fixtures/clients_clean.txt --expected-host a.example.com,|ERROR: --expected-host takes host names
4|--extensions-dir tests/fixtures/missing|ERROR: cannot read extensions folder
4|--clients tests/fixtures/missing.txt|ERROR: cannot read clients file
4|--files-root tests/fixtures/missing|ERROR: cannot read files root
4|--clients tests/fixtures/clients_clean.txt --files-root tests/fixtures/missing|ERROR: cannot read files root
