---
title: APT73 Initial Access via Check Point Security Gateway
description: Detects potential APT73 activity exploiting CVE-2026-50751 in Check Point Security Gateway
status: stable
date: 2026/07/09
author: Security Arsenal
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
  - attack.initial_access
  - attack.t1190
  - apt73
logsource:
  product: firewall
definition: 'Criteria: Firewall must log connection attempts'
detection:
  selection:
    dst_ip|startswith:
      - '192.168.'
      - '10.'
      - '172.16.'
    src_port: 500
    protocol: 'UDP'
    msg|contains:
      - 'IKE'
      - 'VPN'
  condition: selection
falsepositives:
  - Legitimate VPN connections
level: high

---
title: APT73 Lateral Movement via PsExec
description: Detects potential APT73 lateral movement using PsExec
date: 2026/07/09
author: Security Arsenal
status: stable
references:
  - https://attack.mitre.org/techniques/T1021/002/
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - apt73
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName|startswith: '\\*\ADMIN$'
    RelativeTargetName|endswith: '\PSEXESVC.EXE'
  condition: selection
falsepositives:
  - System administration using PsExec
level: medium

---
title: APT73 Pre-Encryption Staging Activity
description: Detects potential APT73 pre-encryption staging indicators
date: 2026/07/09
author: Security Arsenal
status: stable
references:
  - https://attack.mitre.org/techniques/T1074/
tags:
  - attack.collection
  - attack.t1074
  - apt73
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4663
    ObjectType: 'File'
    ObjectName|contains:
      - '.encrypted'
      - '.locked'
      - '.locked2'
  filter:
    SubjectUserName:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
  condition: selection and not filter
falsepositives:
  - Legitimate file encryption tools
level: high

// APT73 Lateral Movement and Pre-Encryption Staging Hunt
let TimeRange = ago(7d);
let ProcessCreationEvents = materialize(
  SecurityEvent
  | where TimeGenerated > TimeRange
  | where EventID == 4688
);
let SuspiciousProcesses = ProcessCreationEvents
  | where NewProcessName in~ (
      "C:\\Windows\\System32\\cmd.exe", 
      "C:\\Windows\\System32\\powershell.exe", 
      "C:\\Windows\\System32\\wscript.exe",
      "C:\\Windows\\System32\\cscript.exe",
      "C:\\Windows\\System32\\mshta.exe"
    )
  | extend CommandLine = tostring(CommandLine)
  | where CommandLine contains "-enc" or 
         CommandLine contains "Invoke-Expression" or
         CommandLine contains "DownloadString" or
         CommandLine contains "IEX";
let NetworkActivity = 
  DeviceNetworkEvents
  | where TimeGenerated > TimeRange
  | where RemoteIPType == "External"
  | where InitiatingProcessFileName in~ (
      "powershell.exe", 
      "cmd.exe", 
      "wscript.exe",
      "rundll32.exe",
      "regsvr32.exe"
    );
union SuspiciousProcesses, NetworkActivity
| summarize count() by bin(TimeGenerated, 1h), Computer, InitiatingProcessFileName, RemoteIP
| where count_ > 5
| project TimeGenerated, Computer, InitiatingProcessFileName, RemoteIP, count_
| sort by count_ desc

# APT73 Rapid Response Hardening Script
# Run as Administrator

Write-Host "Starting APT73 Rapid Response Hardening Script..." -ForegroundColor Cyan

# 1. Check for exposed RDP
Write-Host "\n[1] Checking for exposed RDP access..." -ForegroundColor Yellow
$RDPStatus = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
if ($RDPStatus -eq 0) {
    Write-Host "WARNING: RDP is ENABLED. Consider disabling if not required." -ForegroundColor Red
    Write-Host "To disable RDP, run: Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1" -ForegroundColor Gray
} else {
    Write-Host "RDP is disabled. Good." -ForegroundColor Green
}

# 2. Enumerate scheduled tasks added in the last 7 days
Write-Host "\n[2] Checking for recently added scheduled tasks..." -ForegroundColor Yellow
$DateThreshold = (Get-Date).AddDays(-7)
$RecentTasks = Get-ScheduledTask | Where-Object {$_.Date -gt $DateThreshold}
if ($RecentTasks) {
    Write-Host "Found $($RecentTasks.Count) tasks added in the last 7 days:" -ForegroundColor Yellow
    $RecentTasks | Format-Table TaskName, Author, Date -AutoSize
} else {
    Write-Host "No suspicious scheduled tasks found in the last 7 days." -ForegroundColor Green
}

# 3. Find recently modified Volume Shadow Copies
Write-Host "\n[3] Checking for recently modified Volume Shadow Copies..." -ForegroundColor Yellow
try {
    $VSS = Get-WmiObject -Class Win32_ShadowCopy | Sort-Object InstallDate -Descending | Select-Object -First 10
    if ($VSS) {
        Write-Host "Recent Volume Shadow Copies:" -ForegroundColor Yellow
        $VSS | Format-Table DeviceObject, InstallDate, VolumeName -AutoSize
        
        # Check for suspicious shadow copy deletions
        $VSSDeletionEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='VSS'; ID=12343} -ErrorAction SilentlyContinue
        if ($VSSDeletionEvents) {
            Write-Host "WARNING: Found Volume Shadow Copy deletion events:" -ForegroundColor Red
            $VSSDeletionEvents | Select-Object TimeCreated, Message | Format-List
        }
    } else {
        Write-Host "No recent Volume Shadow Copies found." -ForegroundColor Green
    }
} catch {
    Write-Host "Error checking Volume Shadow Copies: $($_.Exception.Message)" -ForegroundColor Red
}

# 4. Check for suspicious services
Write-Host "\n[4] Checking for suspicious services..." -ForegroundColor Yellow
$SuspiciousServices = Get-WmiObject Win32_Service | Where-Object {
    $_.State -eq "Running" -and 
    $_.PathName -match ".{30,}" -and 
    $_.PathName -notmatch "C:\\Windows\\System32" -and 
    $_.PathName -notmatch "C:\\Program Files" -and 
    $_.PathName -notmatch "C:\\Program Files (x86)"
}
if ($SuspiciousServices) {
    Write-Host "Found $($SuspiciousServices.Count) potentially suspicious services:" -ForegroundColor Red
    $SuspiciousServices | Format-Table Name, DisplayName, PathName, State -AutoSize
} else {
    Write-Host "No suspicious services found." -ForegroundColor Green
}

# 5. Check for Check Point and Cisco devices (based on APT73 CVE exploitation)
Write-Host "\n[5] Checking for potentially vulnerable network devices..." -ForegroundColor Yellow
$NetworkDevices = Get-NetNeighbor -State Reachable | Select-Object -ExpandProperty IPAddress | ForEach-Object {
    try {
        $hostname = [System.Net.Dns]::GetHostEntry($_).HostName
        [PSCustomObject]@{
            IP = $_
            Hostname = $hostname
        }
    } catch {
        # Skip hosts without DNS records
    }
}
$CheckPointDevices = $NetworkDevices | Where-Object { $_.Hostname -match "checkpoint|checkpoint-" }
$CiscoDevices = $NetworkDevices | Where-Object { $_.Hostname -match "cisco|cisco-" }

if ($CheckPointDevices) {
    Write-Host "Found potential Check Point devices (vulnerable to CVE-2026-50751):" -ForegroundColor Red
    $CheckPointDevices | Format-Table -AutoSize
}
if ($CiscoDevices) {
    Write-Host "Found potential Cisco devices (vulnerable to CVE-2026-20131):" -ForegroundColor Red
    $CiscoDevices | Format-Table -AutoSize
}

if (!$CheckPointDevices -and !$CiscoDevices) {
    Write-Host "No obviously vulnerable network devices found." -ForegroundColor Green
}

Write-Host "\nAPT73 Rapid Response Hardening Script completed." -ForegroundColor Cyan
Write-Host "For further investigation, consider running a full forensic analysis." -ForegroundColor Gray


# Incident Response Priorities