title: Potential Check Point Security Gateway RCE (CVE-2026-50751)
id: 88a3b21c-5a3e-4f9d-8c2e-1b5d6e7f8a9c
status: experimental
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 key exchange anomalies and resulting process execution on Check Point gateways.
author: Security Arsenal Research
date: 2026/08/03
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
definition: 'Select attributes whereIKEv1Phase1Exchanges > 50 in 60s'
detection:
    selection:
        dst_port: 500
        protocol: udp
        ikev1_msg_id: 0
    condition: selection | count() by src_ip > 50
falsepositives:
    - Legitimate high-volume VPN re-keying storms
level: high
tags:
    - cve.2026.50751
    - attack.initial_access
    - ransomware.gammax
---
title: Suspicious Process Spawned by Cisco FMC Services (CVE-2026-20131)
id: 99b4c32d-6b4f-5a0e-9d3f-2c6e7f8a9b0d
status: experimental
description: Detects suspicious child processes spawned by Cisco FMC (sfmgr) or Tomcat services, indicative of deserialization exploitation.
author: Security Arsenal Research
date: 2026/08/03
logsource:
    product: linux
    service: auditd
detection:
    selection_parent:
        ppname|contains:
            - 'sfmgr'
            - 'tomcat'
    selection_child:
        name|endswith:
            - 'sh'
            - 'bash'
            - 'python'
            - 'perl'
    condition: selection_parent and selection_child
falsepositives:
    - Administrative scripting
level: critical
tags:
    - cve.2026.20131
    - attack.execution
    - ransomware.gammax
---
title: ConnectWise ScreenConnect Path Traversal Exploit (CVE-2024-1708)
id: 11c5d43e-7c5g-6b1f-0e4g-3d7f8a9b0c1e
status: experimental
description: Detects path traversal attempts in ConnectWise ScreenConnect web requests indicative of authentication bypass.
author: Security Arsenal Research
date: 2026/08/03
logsource:
    category: web
detection:
    selection_uri:
        cs-uri-query|contains:
            - '..%2f'
            - '..\\'
            - 'App_Web'
    selection_host:
        cs-host|contains:
            - ':8040'
            - ':443'
    condition: selection_uri and selection_host
falsepositives:
    - Scanning activity
level: high
tags:
    - cve.2024.1708
    - attack.initial_access
    - ransomware.gammax

// Hunt for web shell activity or process injection on perimeter appliances
// Correlates with Cisco FMC and Check Point exploitation patterns
DeviceProcessEvents  
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("httpd", "nginx", "java", "sfmgr", "cpd")
| where ProcessFileName in ("sh", "bash", "powershell.exe", "cmd.exe", "pwsh")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessFileName, CommandLine, AccountName
| extend HuntingTag = "Potential_Webshell_Perimeter"

# GAMMAX Hardening & Detection Script
# Checks for suspicious scheduled tasks and recent RDP/PowerShell activity
# Run with Administrator privileges

Write-Host "[+] GAMMAX Ransomware Hunt & Harden Script" -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in last 24 hours (Persistence)
Write-Host "\n[*] Checking for Scheduled Tasks created in last 24h..." -ForegroundColor Yellow
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $info = $task | Get-ScheduledTaskInfo
    if ($info.LastRunTime -gt (Get-Date).AddHours(-24)) {
        Write-Host "ALERT: Task $($task.TaskName) last ran at $($info.LastRunTime)" -ForegroundColor Red
        Write-Host "Action: $($task.Actions.Execute)" -ForegroundColor DarkGray
    }
}

# 2. Enumerate recent PowerShell ScriptBlock logs (Defense Evasion)
Write-Host "\n[*] Checking for encoded PowerShell commands in last 24h..." -ForegroundColor Yellow
$events = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($events) {
    $events | Where-Object { $_.Message -match 'EncodedCommand' } | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "No encoded script blocks found." -ForegroundColor Green
}

# 3. Network Connection check for non-standard ports (C2)
Write-Host "\n[*] Checking for established outbound connections on high ports..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -gt 1024 -and $_.LocalAddress -ne "127.0.0.1" } | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess | Format-Table


# Incident Response Priorities

1.  **T-Minus Detection Checklist:**
    *   Immediately audit logs for connections to `AguAseo` and `MTCO` partner domains.
    *   Check Check Point and Cisco FMC logs for spikes in IKEv1 packets or unauthenticated `POST` requests to management interfaces.
    *   Hunt for `ScreenConnect` sessions initialized without user interaction (silent install).

2.  **Critical Assets Prioritized:**
    *   Active Directory Domain Controllers (Golden Ticket abuse).
    *   Backup Servers (VSS deletion attempts).
    *   SCADA/OT Network controllers (for Energy victims).

3.  **Containment Actions:**
    *   **URGENT:** Isolate VPN concentrators and Firewall Management Centers from the internet (Management Plane isolation).
    *   Revoke all VPN credentials for users in the SA and CO regions; force MFA re-registration.
    *   Shut down ConnectWise ScreenConnect services until patched.

# Hardening Recommendations

**Immediate (24h):**
*   **Patch Management:** Apply patches for **CVE-2026-50751** (Check Point), **CVE-2026-20131** (Cisco FMC), and **CVE-2024-1708** (ScreenConnect) immediately. These are confirmed CISA KEV exploits.
*   **Network Segmentation:** Enforce strict Zero Trust policies for management planes of firewalls. Ensure FMC/SmartCenter is not accessible from the internet.

**Short-term (2 weeks):**
*   **Architecture:** Implement a dedicated Out-of-Band (OOB) management network for all security appliances.
*   **Identity:** Deploy phishing-resistant MFA (FIDO2) for all remote access solutions.
*   **Monitoring:** Deploy specific decoys/honeypots on the management VLAN to detect lateral movement from compromised edge devices.