title: Potential DEADLOCK Ransomware Activity - ConnectWise ScreenConnect Exploitation
id: d6b3f8d0-1c2a-4f7d-9e0a-1b2c3d4e5f6a
description: Detects potential exploitation of CVE-2024-1708 involving suspicious paths or process spawning from ScreenConnect services.
status: experimental
date: 2026/07/16
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|contains: 'ScreenConnect'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate administrator usage
level: high
---
title: DEADLOCK Affiliate - Volume Shadow Copy Deletion
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects commands used to delete Volume Shadow Copies, a common step prior to DEADLOCK encryption.
status: experimental
date: 2026/07/16
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy delete'
    condition: 1 of selection_
falsepositives:
    - System administration scripts
level: critical
---
title: DEADLOCK - Rclone Data Exfil Tool Execution
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
description: Detects execution of rclone, a tool frequently used by DEADLOCK affiliates for large-scale data exfiltration.
status: experimental
date: 2026/07/16
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'megacopy'
    condition: selection
falsepositives:
    - Legitimate backup utilities using rclone
level: high


**KQL (Microsoft Sentinel) - Pre-Encryption Staging Hunt**

kql
// Hunt for rapid file modifications and potential staging
// indicative of ransomware preparation
DeviceFileEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessAccountName != "System" 
| where FolderPath contains "\AppData\Local\Temp" 
or FolderPath contains "C:\Windows\Temp"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
| where ActionType in ("FileCreated", "FileModified")
| summarize FileCount = count(), DistinctFiles = dcount(FileName) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 5m)
| where FileCount > 10
| order by FileCount desc


**PowerShell - Hardening & Detection Script**

powershell
# DEADLOCK Rapid Response Hardening Script
# Checks for exposed RDP, recent scheduled tasks (persistence), and VSS health.

Write-Host "[+] Starting DEADLOCK Hardening Check..." -ForegroundColor Cyan

# 1. Check for Recent Scheduled Tasks (Persistence)
Write-Host "\n[*] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
$DateCutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $DateCutoff} | Select-Object TaskName, TaskPath, Date, Author

# 2. Check for RDP Exposure (Firewall)
Write-Host "\n[*] Checking RDP Firewall Rules..." -ForegroundColor Yellow
$RdpRules = Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*Remote Desktop*" -and $_.Enabled -eq 'True'}
if ($RdpRules) {
    Write-Host "[!] WARNING: RDP Firewall Rules are Active:" -ForegroundColor Red
    $RdpRules | Select-Object DisplayName, Enabled, Direction | Format-Table
} else {
    Write-Host "[+] No active RDP firewall rules found." -ForegroundColor Green
}

# 3. Check Shadow Copy Storage (Resilience)
Write-Host "\n[*] Checking Volume Shadow Copy Storage..." -ForegroundColor Yellow
try {
    $vss = gwmi -Class Win32_ShadowCopy
    if ($vss) {
        Write-Host "[+] Found $($vss.Count) Shadow Copies."
        $vss | Select-Object InstallDate, VolumeName, DeviceObject | Format-Table
    } else {
        Write-Host "[!] CRITICAL: No Shadow Copies found. System is vulnerable to data loss." -ForegroundColor Red
    }
} catch {
    Write-Host "Error checking VSS: $_" -ForegroundColor Red
}

Write-Host "\n[+] Check complete." -ForegroundColor Cyan


---

# Incident Response Priorities

1.  **T-Minus Detection Checklist:**
    *   Immediately review logs for successful authentication to **ConnectWise ScreenConnect** instances originating from unusual IPs or followed by immediate PowerShell execution.
    *   Hunt for **Check Point VPN** logs indicating successful IKEv1 handshake with invalid or mismatched peer IDs (CVE-2026-50751).
    *   Monitor for spikes in outbound traffic on non-standard ports (potential exfil via rclone).

2.  **Critical Assets for Exfil:**
    Based on victimology, DEADLOCK prioritizes:
    *   **PII/PHI** (Healthcare victims like DOCTUS USA).
    *   **Financial Records & Client Databases** (Business Services/Legal).
    *   **Proprietary Schematics & Blueprints** (Construction/Manufacturing).

3.  **Containment Actions:**
    *   **Isolate:** Disconnect internet-facing VPN and RMM interfaces immediately if compromise is suspected.
    *   **Disable:** Turn off local admin accounts and enforce "Smart Card Required" for domain admins if possible.
    *   **Preserve:** Snapshot memory of servers hosting ConnectWise or VPN appliances before rebooting to capture exploitation artifacts.

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch CVE-2024-1708:** Apply the latest hotfixes to all ConnectWise ScreenConnect instances immediately. If patching is impossible, restrict access to trusted IPs via firewall.
*   **Patch CVE-2026-50751:** Update Check Point Security Gateways to the latest version to fix the IKEv1 authentication bypass.
*   **Audit RMM:** Review all active sessions in RMM tools; enforce MFA for all technicians.

**Short-term (2 Weeks):**
*   **Network Segmentation:** Move RMM and VPN management interfaces to a dedicated management VLAN, strictly separated from user data and production servers.
*   **Implement CASB:** Deploy Cloud Access Security Broker rules to detect and block large-scale data transfers to personal cloud storage (Mega, MediaFire) often used by DEADLOCK.

---