---
title: Potential CRPXO Initial Access via ConnectWise ScreenConnect
id: 8a3f2c91-1b4d-4c5a-9e8f-1a2b3c4d5e6f
description: Detects path traversal and authentication bypass attempts associated with CVE-2024-1708 on ConnectWise ScreenConnect servers.
author: Security Arsenal Intel
status: experimental
date: 2026/08/01
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '%2f..' # Path traversal encoding
            - 'SetupWizard'
            - 'PartialView'
        c-ip|startswith:
            - '10.'
            - '192.168.'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare with these specific paths)
level: critical
---
title: CRPXO Lateral Movement via PsExec with Sinkhole Pattern
description: Detects PsExec usage creating services with names matching CRPXO affiliate patterns observed in recent campaigns.
id: 7b2e1d80-0a3c-4b59-8d7e-0a1b2c3d4e5f
author: Security Arsenal Intel
status: experimental
date: 2026/08/01
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\psexec.exe'
    selection_cli:
        CommandLine|contains:
            - '-accepteula'
            - '\\192.168.'
    selection_service:
        CommandLine|contains:
            - 'UpdateSvc'
            - 'SystemMaintenance'
    condition: all of selection_*
falsepositives:
    - Administrative IT maintenance
level: high
---
title: CRPXO Data Staging - Rapid Archive Creation
id: 6c1d0c79-9z2b-3a48-7c6d-9z0a1b2c3d4e
author: Security Arsenal Intel
status: experimental
date: 2026/08/01
description: Detects high-speed compression and archiving often indicative of data exfiltration staging before encryption.
logsource:
    category: process_creation
    product: windows
detection:
    selection_tool:
        Image|endswith:
            - '\winrar.exe'
            - '\7z.exe'
            - '\tar.exe'
    selection_params:
        CommandLine|contains:
            - '-m0' # Store only (fast)
            - '-mx1' # Fastest compression
    selection_volume:
        FileName|contains:
            - 'D:\'
            - 'E:\'
            - '\\NAS\'
    timeframe: 5m
    condition: selection_tool and selection_params and selection_volume | count() > 5
falsepositives:
    - Legitimate system backups
level: medium


kql
// KQL Hunt for CRPXO Pre-Encryption Activity (Lateral Movement & Staging)
// Focus on anomalous SMB writes and Service Creation
let TimeRange = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeRange)
// Hunt for lateral movement tools
| where FileName in~ ("psexec.exe", "wmi.exe", "wmic.exe", "powershell.exe")
// Filter for encoded commands or specific parameters
| where ProcessCommandLine has "-enc" 
   or ProcessCommandLine matches regex @"\\\\\\d+\\.\\d+\\.\\d+\\.\\d+" // IP addresses in args
// Correlate with network events
| join kind=inner (DeviceNetworkEvents 
    | where Timestamp > ago(TimeRange)
    | where RemotePort == 445 or RemotePort == 135 
    | where InitiatingProcessFileName in~ ("psexec.exe", "services.exe")
) on DeviceId, Timestamp
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessAccountName


powershell
# CRPXO Rapid Response Hardening Script
# Execute with Administrator privileges

Write-Host "[!] CRPXO Incident Response Hardening - $(Get-Date)" -ForegroundColor Cyan

# 1. Check for Scheduled Tasks added in last 7 days (Persistence)
Write-Host "[*] Checking for recently created Scheduled Tasks..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7) -and 
    $_.Author -notmatch "Microsoft|NT AUTHORITY"
} | Select-Object TaskName, Author, Date, Actions | Format-Table -AutoSize

# 2. Check for Shadow Copy Deletion attempts (Defense Evasion)
Write-Host "[*] Checking Volume Shadow Copy Status..." -ForegroundColor Yellow
vssadmin list shadows | Select-String "No shadow copies present"

# 3. Identify RDP/Remote Access Logons (Lateral Movement)
Write-Host "[*] Hunting for anomalous RDP logons (last 24h)..." -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
Where-Object {$_.Message -match 'Logon Type: 10' -and $_.Message -notmatch 'Network Account'} |
Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='IP';E={$_.Properties[19].Value}} | Format-Table -AutoSize

# 4. Block Common Ransomware Ports via Firewall (Immediate Containment)
Write-Host "[*] Applying Firewall Hardening Rules..." -ForegroundColor Yellow
$PortsToBlock = @(445, 135, 139, 3389)
foreach ($port in $PortsToBlock) {
    New-NetFirewallRule -DisplayName "Block CRPXO Related Port $port" -Direction Inbound -LocalPort $port -Protocol TCP -Action Block -ErrorAction SilentlyContinue
}
Write-Host "[+] Hardening Complete." -ForegroundColor Green


# Incident Response Priorities

**T-minus Detection Checklist:**
- **Review ConnectWise ScreenConnect logs** immediately for `SetupWizard` or `PartialView` path traversal strings (CVE-2024-1708).
- **Cisco FMC Audit:** Check management interface logs for deserialization anomalies or unexpected configuration changes (CVE-2026-20131).
- **SMB Traffic:** Identify systems performing massive file reads (read > write) from file shares during non-business hours.

**Critical Assets at Risk:**
- **SWIFT/Banking Infrastructure:** Confirmed interest in Turkish banks (Kuveyt Turk, Finansbank).
- **Intellectual Property:** Aselsan (Defense) and Hyundai (Manufacturing) suggest theft of proprietary schematics.

**Containment Actions:**
1.  **Isolate:** Disconnect VPN concentrators and identified ConnectWise jump hosts from the network.
2.  **Suspend:** Suspend service accounts used for backup/scheduled tasks immediately.
3.  **Preserve:** Acquire memory images of domain controllers before shutting down to identify lateral movement tools.

# Hardening Recommendations

**Immediate (24h):**
- **Patch CVE-2024-1708 (ConnectWise):** Apply the vendor-supplied hotfix immediately. If patching is not possible, disable ScreenConnect web interfaces externally.
- **Patch CVE-2026-20131 (Cisco FMC):** Restrict management plane access to /32 IP addresses only.
- **Block RDP:** Enforce strict firewall rules blocking inbound RDP from the internet.

**Short-term (2 weeks):**
- **Phishing-Resistant MFA:** Deploy FIDO2 hardware keys for all administrative logons (VPN, Firewall, O365).
- **Network Segmentation:** Implement Zero Trust segmentation for backup repositories to prevent ransomware from encrypting VSS copies.
- **Egress Filtering:** Block outbound traffic to known CRPXO C2 infrastructure and non-standard ports (e.g., 8080, 8443) except for specific business requirements.