DEADLOCK Ransomware: Global Tech Sector Surge — Check Point & ScreenConnect Exploitation Analysis

---
title: Potential ScreenConnect Authentication Bypass / Path Traversal
id: c4eab9e1-6b2c-4e8a-9e5a-1a2b3c4d5e6f
description: Detects potential exploitation of CVE-2024-1708 (ScreenConnect Path Traversal) based on suspicious URI patterns in web logs.
status: experimental
date: 2026/07/31
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/Bin/'
            - '.aspx'
        cs-uri-query|re: '.*%2f%2f.*|.*%5c%5c.*'
    condition: selection
falsepositives:
    - Legitimate administrative access via unusual clients
level: high
---
title: Suspicious Lateral Movement via PsExec or WMI
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects lateral movement patterns often used by ransomware gangs like DEADLOCK involving PsExec or WMI command line invocation.
status: experimental
date: 2026/07/31
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\psexec.exe'
            - '\psexec64.exe'
            - '\wmic.exe'
    selection_cli:
        CommandLine|contains:
            - 'remote '
            - '/node:'
            - 'process call create'
    condition: all of selection_*
falsepositives:
    - System administration tasks
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
---
title: Ransomware Pre-Encryption VSS Shadow Copy Deletion
id: 9876fedc-5432-10ba-9876-543210fedcba
description: Detects commands used to delete Volume Shadow Copies via vssadmin or wmic, a common step immediately preceding encryption.
status: experimental
date: 2026/07/31
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy delete'
    condition: 1 of selection_*
level: critical
tags:
    - attack.impact
    - attack.t1490

// Hunt for DEADLOCK lateral movement and data staging
// Looks for PowerShell spawning PsExec/WMI followed by network activity
let ProcessEvents = Materialize(
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName =~ "powershell.exe" or InitiatingProcessFileName =~ "pwsh.exe"
    | where FileName in~ ("psexec.exe", "psexec64.exe", "wmic.exe", "robocopy.exe", "rclone.exe")
    | project DeviceName, Timestamp, ProcessCommandLine, AccountName, InitiatingProcessAccountName
);
let NetworkEvents = Materialize(
    DeviceNetworkEvents
    | where Timestamp > ago(1h)
    | where RemotePort in (443, 80, 21, 22) or ActionType in ("ConnectionSuccess", "ConnectionAllowed")
    | summarize SentBytes=sum(SentBytes), ReceivedBytes=sum(ReceivedBytes) by DeviceName, RemoteUrl, RemoteIP
    | where SentBytes > 5000000 // Greater than 5MB sent (potential exfil)
);
ProcessEvents
| join kind=inner NetworkEvents on DeviceName
| project DeviceName, Timestamp, ProcessCommandLine, RemoteUrl, RemoteIP, SentBytes
| order by Timestamp desc

# DEADLOCK Hardening & Detection Script
# Checks for recent scheduled tasks (persistence) and VSS manipulation

Write-Host "[+] Checking for recently created Scheduled Tasks (Last 7 Days)..." -ForegroundColor Cyan
$Date = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Date -ge $Date } | Select-Object TaskName, TaskPath, Date, Author | Format-Table -AutoSize

Write-Host "[+] Checking for Volume Shadow Copy Service (VSS) errors or deletions in Event Logs..." -ForegroundColor Cyan
$VSSEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; StartTime=$Date} -ErrorAction SilentlyContinue
if ($VSSEvents) {
    $VSSEvents | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-List
} else {
    Write-Host "No significant VSS events found in the last 7 days." -ForegroundColor Green
}

Write-Host "[+] Auditing exposed RDP/Management Ports..." -ForegroundColor Cyan
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -in @(3389, 5900, 8080, 443) } | 
    Select-Object LocalAddress, LocalPort, OwningProcess | Format-Table -AutoSize