CRPXO Ransomware: Cross-Sector Surge & Firewall Exploitation — Detection Engineering Brief

---
title: Potential Check Point VPN Gateway IKEv1 Exploitation (CVE-2026-50751)
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential exploitation attempts of CVE-2026-50751 involving unusual IKEv1 packet sizes or authentication failures on Check Point gateways.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/27
tags:
    - attack.initial_access
    - cve.2026.50751
    - detection.emerging-threats
logsource:
    category: firewall
product: check_point
detection:
    selection:
        product: 'VPN'
        protocol: 'IKE'
        version: 'v1'
    condition: selection | count() > 50
falsepositives:
    - Legitimate misconfigured VPN clients
level: high
---
title: ConnectWise ScreenConnect Path Traversal Exploitation (CVE-2024-1708)
id: e5f6g7h8-9012-34cd-efab-567890abcdef
status: experimental
description: Detects web request patterns associated with CVE-2024-1708 exploitation on ConnectWise ScreenConnect servers.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/27
tags:
    - attack.initial_access
    - cve.2024.1708
    - attack.web_shells
logsource:
    category: webserver
product: connectwise_screenconnect
detection:
    selection_uri:
        cs-uri-query|contains:
            - '..%2f'
            - '..\\'
    selection_ext:
        cs-uri-query|contains:
            - '.aspx'
            - '.ashx'
    condition: all of selection_*
falsepositives:
    - Scanning activity
level: critical
---
title: CRPXO Suspicious Data Staging via Rclone
definition:
    - 'Rclone is a command-line program to sync files and directories to cloud storage, often abused by ransomware actors for exfiltration.'
    - 'Detection: Process execution of rclone.exe with specific flags indicating rapid file transfer to non-standard cloud endpoints.'
status: experimental
date: 2026/07/27
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\rclone.exe'
        - OriginalFileName: 'rclone.exe'
    selection_cli:
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'mega'
            - 'pcloud'
    condition: all of selection_*
falsepositives:
    - Legitimate admin backups
level: high

// Hunt for lateral movement and staging indicators associated with CRPXO
// Focus on PSExec, WMI, and abnormal mass file modifications
let Timeframe = 1d;
DeviceProcessEvents
| where Timestamp >= ago(Timeframe)
| where InitiatingProcessFileName in ("psexec.exe", "psexec64.exe", "wmic.exe", "powershell.exe")
| where ProcessCommandLine has any(@("-accepteula", "process call create", "Invoke-Expression", "DownloadString", "IEX"))
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, InitiatingProcessFileName, ProcessCommandLine, FolderPath
| join kind=inner (
    DeviceFileEvents
    | where Timestamp >= ago(Timeframe)
    | where ActionType == "FileCreated"
    | summarize count() by DeviceName, bin(Timestamp, 5m)
    | where count_ > 50 // High volume of file creation in 5 mins
    | project DeviceName, StagingTime = Timestamp
) on $left.DeviceName == $right.DeviceName
| where Timestamp between (StagingTime - 5m .. StagingTime + 5m)

<#
.SYNOPSIS
    Rapid Response Hardening Script for CRPXO Indicators
.DESCRIPTION
    Checks for recent scheduled task creation (persistence),
    abnormal VSS shadow copy deletions, and enumerates exposed RDP sessions.
#>

Write-Host "[+] Starting CRPXO Rapid Response Check..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in last 48 hours (Persistence)
Write-Host "[*] Checking for suspicious scheduled tasks created in last 48h..." -ForegroundColor Yellow
$DateCutoff = (Get-Date).AddDays(-2)
Get-ScheduledTask | Where-Object { $_.Date -gt $DateCutoff } | ForEach-Object {
    $Task = $_
    $Action = $Task.Actions.Execute
    $Author = $Task.Author
    Write-Host "[!] Suspicious Task Found: $($Task.TaskName) | Author: $Author | Action: $Action" -ForegroundColor Red
}

# 2. Check for VSSAdmin deletions (Pre-encryption activity)
Write-Host "[*] Checking Event Logs for VSSAdmin deletion events..." -ForegroundColor Yellow
$VSSEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=12345} -ErrorAction SilentlyContinue
if ($VSSEvents) {
    Write-Host "[!] VSS Deletion Events Detected:" -ForegroundColor Red
    $VSSEvents | Select-Object TimeCreated, Message | Format-List
}

# 3. Enumerate RDP Sessions (Lateral Movement)
Write-Host "[*] Enumerating active RDP sessions..." -ForegroundColor Yellow
query user

Write-Host "[+] Check Complete." -ForegroundColor Cyan


---