ANUBIS Ransomware: Critical Infrastructure Exploits Target Healthcare and Business Services

title: Potential ScreenConnect Path Traversal Exploit CVE-2024-1708
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential webshell activity or authentication bypass associated with ConnectWise ScreenConnect path traversal vulnerability.
status: experimental
date: 2026/07/13
author: Security Arsenal
logsource:
  category: web
  product: proxy
detection:
  selection:
    cs-uri-query|contains:
      - 'App_Extensions'
      - 'Services'
      - 'bin'
    cs-uri-query|contains:
      - '.aspx'
      - '.ashx'
    sc-status: 200
  filter:
    cs-uri-query|contains:
      - 'Login'
      - 'Guest'
  condition: selection and not filter
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve-2024-1708
  - anubis

---
title: Suspicious Exchange PowerShell Deserialization Activity
id: e5f6g7h8-9012-34ij-klmn-567890123456
description: Detects suspicious PowerShell commands often used post-exploitation in Microsoft Exchange deserialization attacks.
status: experimental
date: 2026/07/13
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  selection_id:
    EventID: 4688
  selection_process:
    NewProcessName|endswith: \powershell.exe
  selection_cmdline:
    CommandLine|contains:
      - 'New-Object'
      - 'System.Management.Automation.AmsiUtils'
      - 'System.Reflection.Assembly'
      - 'DownloadString'
    CommandLine|contains:
      - 'Exchange'
      - 'IIS'
      - 'HttpProxy'
  condition: all of selection_*
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - cve-2023-21529
  - anubis

---
title: Ransomware Lateral Movement via SMB and PsExec
id: m9n0o1p2-3456-78qr-stuv-901234567890
description: Detects lateral movement patterns consistent with ANUBIS propagation using PsExec or SMB administrative shares.
status: experimental
date: 2026/07/13
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  selection_smb:
    EventID: 5140
    ShareName|contains:
      - 'ADMIN$'
      - 'C$'
    SubjectUserName|contains:
      - 'ADMIN'
      - 'svc'
  selection_psexec:
    EventID: 4688
    NewProcessName|contains:
      - '\psexec.exe'
      - '\psexec64.exe'
      - '\PAExec.exe'
    CommandLine|contains: '\\'
  condition: 1 of selection_*
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - anubis

// Hunt for potential lateral movement and data staging associated with Anubis
// Looks for rapid file modifications or mass copy operations across the network
SecurityEvent
| where EventID in (5140, 5145) // File share access
| project TimeGenerated, Computer, SubjectUserName, ShareName,IpAddress, AccessMask
| where SubjectUserName != "ANONYMOUS LOGON"
| summarize count() by IpAddress, SubjectUserName, bin(TimeGenerated, 5m)
| where count_ > 10 // Threshold for excessive share access
| join kind=inner (
    SecurityEvent
    | where EventID == 4624 // Logon Type 3 (Network) or 10 (RemoteInteractive)
    | where LogonType in (3, 10)
    | project TimeGenerated, Computer, TargetUserName, IpAddress
) on IpAddress
| project TimeGenerated, IpAddress, SubjectUserName, TargetUserName, Computer
| order by TimeGenerated desc

# ANUBIS Response Script: Check for RDP exposure, Scheduled Tasks, and VSS Tampering
# Requires Administrator Privileges

Write-Host "[+] Starting ANUBIS Hardening Check..." -ForegroundColor Cyan

# 1. Check for exposed RDP (Registry based check)
$RDPPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server"
$fDenyTSConnections = (Get-ItemProperty -Path $RDPPath).fDenyTSConnections
if ($fDenyTSConnections -eq 0) {
    Write-Host "[WARNING] RDP is ENABLED. Consider disabling if not required." -ForegroundColor Red
} else {
    Write-Host "[OK] RDP is Disabled." -ForegroundColor Green
}

# 2. Enumerate Scheduled Tasks created in the last 7 days
$DateCutoff = (Get-Date).AddDays(-7)
Write-Host "\n[+] Checking Scheduled Tasks created/modified in the last 7 days..." -ForegroundColor Cyan

Get-ScheduledTask | Where-Object { 
    $_.Date -gt $DateCutoff -or 
    (Get-ScheduledTaskInfo $_).LastRunTime -gt $DateCutoff 
} | ForEach-Object {
    $TaskInfo = Get-ScheduledTaskInfo $_
    Write-Host "Task Name: $($_.TaskName) | Author: $($_.Author) | Last Run: $($TaskInfo.LastRunTime)" -ForegroundColor Yellow
}

# 3. Check for recent Volume Shadow Copy (VSS) modifications or deletions
# VSS writers often fail or are targeted before encryption
Write-Host "\n[+] Checking VSS Writer State..." -ForegroundColor Cyan
try {
    vssadmin list writers 2>&1 | Select-String "State" | ForEach-Object {
        if ($_ -notlike "*[1-9] errors*" -and $_ -notlike "*State: [1-9]*") {
            # A crude check, usually stable state is 1 (Stable) or 5 (Waiting for completion)
            # We look for generic writer state output to ensure no critical failures
        }
    }
    Write-Host "[OK] VSS Writers queried. Verify output manually for errors." -ForegroundColor Green
} catch {
    Write-Host "[ERROR] Could not query VSS writers." -ForegroundColor Red
}

# Check for processes typical of ransomware staging (RClone, WinRAR, 7zip)
$StagingProcs = @("rclone.exe", "winrar.exe", "7z.exe", "powershell.exe")
Write-Host "\n[+] Checking for high-risk staging processes..." -ForegroundColor Cyan
Get-Process | Where-Object { $StagingProcs -contains $_.ProcessName } | Select-Object ProcessName, CPU, StartTime | Format-Table

Write-Host "\n[+] Script Complete." -ForegroundColor Cyan


---