CVE-2024-24919 and CVE-2024-37079: CISA KEV Alert — Critical Detection and Remediation Guide

---
title: Potential Check Point VPN Exploitation (CVE-2024-24919)
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects suspicious process spawning by Check Point VPN processes (vpnd/cpd) indicative of exploitation or reverse shell activity.
references:
  - https://support.checkpoint.com/results/sk/sk182336
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/vpnd'
      - '/cpd'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/nc'
      - '/netcat'
  condition: selection
falsepositives:
  - Legitimate administrative debugging
level: critical
---
title: Suspicious MSIX Deployment Activity (CVE-2024-37079)
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects execution of MSIX deployment tools with suspicious arguments or paths commonly abused in .NET RCE exploits.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37079
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'Add-AppxPackage'
      - '.msix'
      - '.appx'
  filter:
    CommandLine|contains:
      - 'Program Files'
      - 'Microsoft\\WindowsApps'
  condition: selection and not filter
falsepositives:
  - Legitimate software installation by IT
level: high

// Hunt for Check Point VPN anomalies via Syslog/CEF
// Note: Adjust DeviceVendor and DeviceProduct based on your CEF normalization
Syslog
| where Facility contains "local4" // Common Check Point facility
| where SyslogMessage has "IKE" or SyslogMessage has "vpn"
| extend Msg = parse_(SyslogMessage)
| where Msg isnull () // Fallback for text parsing if not JSON
| project TimeGenerated, Computer, HostIP, ProcessName, Message
| where Message has "decryption failed" or Message has "packet_parse_error"
| summarize count() by TimeGenerated, Computer, Message
| where count_ > 10

-- Hunt for shell processes parented by Check Point daemons on Linux Gateways
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE ParentName =~ 'vpnd'
   OR ParentName =~ 'cpd'
   OR Name =~ 'nc' OR Name =~ 'netcat'

#!/bin/bash
# Verification and Remediation Script for CVE-2024-24919 (Check Point)
# Run as root on the Security Gateway

echo "[+] Checking Check Point Gateway Version..."

# Get version info (requires clish or expert mode)
VERSION=$(clish -c "show version" | grep "Check Point's products")
echo "Current Version: $VERSION"

# Check for the specific hotfix Take 177 or later for R81.10/R81.20
# Adjust the Jumbo Take ID based on the specific SK in the advisory
INSTALLED_HOTFIXES=$(cpinfo -y all | grep "JUMBO_HOTFIX")

echo "[+] Checking installed Jumbo Hotfixes..."
echo "$INSTALLED_HOTFIXES"

# Check if the service is vulnerable (looking for old vpnd binary timestamp)
VPND_DATE=$(stat -c %y /opt/CPsuite-*/fw1/bin/vpnd 2>/dev/null | cut -d' ' -f1)

echo "[!] vpnd binary date: $VPND_DATE"
echo "[!] If this date is prior to the patch release date of May 2024, you are vulnerable."
echo "[+] Apply the latest Jumbo Hotfix immediately via CPUSE."