---
title: Potential DragonForce Initial Access - Check Point IKEv1 Vulnerability Exploit
id: 558c5d8d-9946-45b3-8a6d-9c6b2e0f9a1d
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 key exchange anomalies on Check Point Security Gateways. Monitor for spikes in VPN errors or unauthenticated IKE requests.
status: experimental
date: 2026/07/21
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
detection:
    selection:
        action|contains: 'deny'
        dst_port: 500
        protocol: 'udp'
        app|contains: 'ike'
        msg|contains:
            - 'ikev1'
            - 'invalid cookie'
            - 'authentication failed'
    condition: selection | count() > 50
falsepositives:
    - Legitimate misconfigured VPN clients
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
    - dragonforce
---
title: DragonForce Lateral Movement via PsExec and WMI
id: 99d8e7a1-b4c2-4d5e-8f9a-1b2c3d4e5f6g
description: Detects typical lateral movement patterns associated with DRAGONFORCE involving PsExec usage and WMI process creation. They frequently use these tools to deploy payloads across the network.
status: experimental
date: 2026/07/21
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith: '\psexec.exe'
        CommandLine|contains: '-accepteula'
    selection_wmi:
        Image|endswith: '\wmiprvse.exe'
        ParentImage|endswith: '\svchost.exe'
    condition: 1 of selection_*
falsepositives:
    - Administrative IT management activities
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - dragonforce
---
title: DragonForce Data Staging - Large Volume Archive Creation
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
description: Identifies potential data staging activity by DRAGONFORCE prior to exfiltration. This rule triggers on the creation of large compressed archives (rar, 7z, zip) in temp directories, often used to bundle data for theft.
status: experimental
date: 2026/07/21
author: Security Arsenal Research
logsource:
    category: file_create
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Temp\'
            - '\Public\'
        TargetFilename|endswith:
            - '.zip'
            - '.rar'
            - '.7z'
    filter_legit:
        Image|contains:
            - '\Program Files\'
            - '\Windows\System32\'
    condition: selection and not filter_legit
falsepositives:
    - User creating personal backups
level: medium
tags:
    - attack.collection
    - attack.t1560.001
    - dragonforce

// DRAGONFORCE Activity Hunt: Lateral Movement & Staging
let TimeFrame = 1d;
// Look for PsExec/WMI execution often used by this group
let LateralMovement =
    DeviceProcessEvents
    | where Timestamp > ago(TimeFrame)
    | where FileName in~ ("psexec.exe", "psexec64.exe", "wmic.exe")
       or ProcessCommandLine has_any ("-accepteula", "process call create", "node:");
// Look for mass archiving (data staging) before exfil
let DataStaging =
    DeviceFileEvents
    | where Timestamp > ago(TimeFrame)
    | where FileName endswith_cs (".zip", ".rar", ".7z")
    | where InitiatingProcessFileName !in~ ("explorer.exe", "winrar.exe", "7zFM.exe")
    | where FileSize > 10485760; // > 10MB
// Combine results for analysts
union LateralMovement, DataStaging
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName, FileSize
| order by Timestamp desc

# DRAGONFORCE Response Script: Check Recent Scheduled Tasks & Shadow Copies
Write-Host "[*] DRAGONFORCE Rapid Response Checks" -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created/modified in the last 7 days
Write-Host "\n[+] Checking for Scheduled Tasks created/modified in the last 7 days..." -ForegroundColor Yellow
$cutoffDate = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $taskInfo = $task | Get-ScheduledTaskInfo
    if ($taskInfo.LastRunTime -gt $cutoffDate -or $task.Date -gt $cutoffDate) {
        Write-Host "    SUSPICIOUS TASK:" -ForegroundColor Red
        Write-Host "    Name: $($task.TaskName)"
        Write-Host "    Path: $($task.TaskPath)"
        Write-Host "    Last Run: $($taskInfo.LastRunTime)"
        Write-Host "    Action: $($task.Actions.Execute)"
        Write-Host "    Author: $($task.Author)"
        Write-Host "----------------------------------------"
    }
}

# 2. Check Volume Shadow Copy Service (VSS) status
Write-Host "\n[+] Checking Volume Shadow Copy Storage Health..." -ForegroundColor Yellow
try {
    $vss = vssadmin list shadows
    if ($vss -match "No shadow copies found") {
        Write-Host "    [!] WARNING: No shadow copies found on the system. Recovery may be impossible." -ForegroundColor Red
    } else {
        Write-Host "    [+] Shadow copies exist. Verify age and count manually." -ForegroundColor Green
    }
} catch {
    Write-Host "    [!] Error querying VSS." -ForegroundColor Red
}

Write-Host "\n[*] Checks complete." -ForegroundColor Cyan


---

# Incident Response Priorities

**T-minus Detection Checklist (Pre-Encryption):**
*   **VPN/Firewall Logs:** Immediate review of logs for indicators of CVE-2026-50751 exploitation (IKEv1 anomalies).
*   **New Accounts:** Hunt for suspicious local or domain administrator accounts created within the last 48 hours.
*   **Mass Archiving:** Monitor for processes like `winrar.exe` or `7z.exe` running from non-standard paths.

**Critical Assets for Exfiltration:**
*   Customer databases (PII).
*   Financial records and transaction logs.
*   Intellectual property / Source code.
*   Executive email archives.

**Containment Actions (Ordered by Urgency):**
1.  **Isolate:** Disconnect affected segments from the core network; disable VPN access for non-essential accounts immediately.
2.  **Revoke:** Force password resets for all privileged accounts (Domain Admins). Revoke any persistent session tokens.
3.  **Patch:** Apply the out-of-band patch for CVE-2026-50751 on all Check Point Gateways immediately.
4.  **Preserve:** Snapshot memory of active Domain Controllers and critical servers for forensic analysis before shutdown.

---

# Hardening Recommendations

**Immediate (24h):**
*   **Patch Management:** Prioritize patching **CVE-2026-50751 (Check Point)** and **CVE-2026-20131 (Cisco FMC)**. Disable IKEv1 on Check Point gateways if not required.
*   **Access Control:** Enforce MFA on all VPN and remote access solutions immediately. Block internet-accessible RDP (TCP 3389) at the firewall.
*   **Asset Inventory:** Identify all instances of ConnectWise ScreenConnect and ensure they are patched against CVE-2024-1708.

**Short-term (2 weeks):**
*   **Network Segmentation:** Restrict lateral movement by implementing strict micro-segmentation between server tiers (e.g., DB servers cannot initiate connections to user workstations).
*   **EDR/XDR Deployment:** Ensure EDR agents are deployed on all critical assets, including edge firewalls and VPN concentrators (if supported).
*   **Zero Trust:** Implement a Zero Trust Network Access (ZTNA) policy to replace implicit trust in internal network traffic.

---