GENESIS Ransomware: 3 New Victims Posted — US/DK Tech & Manufacturing Sector Attack

---
title: Potential ScreenConnect Authentication Bypass (CVE-2024-1708)
id: 8a5c2f1d-9e3b-4a5c-8b1a-0d2e3f4a5b6c
description: Detects suspicious child processes spawned by ConnectWise Control (ScreenConnect) client, indicative of web shell exploitation or authentication bypass.
author: Security Arsenal Research
date: 2026/08/02
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\ConnectWise.Control.Client.exe'
        NewProcessName|contains:
            - 'powershell.exe'
            - 'cmd.exe'
            - 'pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use by IT support
level: critical
---
title: Check Point VPN Malicious IKEv1 Activity Indicator
id: 7b4a1e0c-8d2a-3b4d-9c0b-1c2d3e4f5a6b
description: Detects potential post-exploitation activity associated with Check Point Security Gateway vulnerabilities. Focuses on unexpected process execution patterns often seen after VPN pivot.
author: Security Arsenal Research
date: 2026/08/02
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - 'snx.exe'
            - 'tracert.exe'
        ParentImage|contains: 'System'
    filter_legit:
        CommandLine|contains: 'disconnect'
    condition: selection and not filter_legit
falsepositives:
    - Standard VPN client usage
level: high
---
title: GENESIS Lateral Movement via PsExec
id: 9c6d3f2e-0e4c-5d6e-1d2c-3e4f5a6b7c8d
description: Detects the use of PsExec for lateral movement, a common tool in the GENESIS playbook for payload deployment.
author: Security Arsenal Research
date: 2026/08/02
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\psexec.exe'
        CommandLine|contains:
            - '-accepteula'
            - '\\\\'
    condition: selection
falsepositives:
    - System administration activities
level: critical


**KQL (Microsoft Sentinel) — Pre-Encryption Staging Hunt**
Hunt for large-scale data staging (Data Exfil) typically preceding GENESIS encryption.

kql
DeviceFileEvents
| where Timestamp > ago(3d)
| where ActionType == "FileCreated"
| where FileName in~ ("archive.zip", "backup.zip", "data.rar", "exfil.ps1")
| where FileSize > 10000000 // > 10MB
| summarize count(), arg_max(Timestamp, *) by DeviceName, InitiatingProcessAccountName
| project-reorder DeviceName, InitiatingProcessAccountName, FileName, FolderPath, Timestamp


**Rapid Response PowerShell Script**
Execute this script on critical endpoints to identify persistence mechanisms and data staging commonly used by GENESIS.

powershell
<#
Genesis ransomware emergency response script.
Checks for suspicious scheduled tasks and recent VSS shadow copy deletions.
#>

Write-Host "[+] Initiating GENESIS Emergency Check..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 7 days (Persistence)
$suspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}
if ($suspiciousTasks) {
    Write-Host "[!] WARNING: Suspicious Scheduled Tasks found recently:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author | Format-Table
} else {
    Write-Host "[-] No suspicious recent scheduled tasks found." -ForegroundColor Green
}

# 2. Check for VSSAdmin deletion attempts in Event Logs (Pre-Encryption)
$vssEvents = Get-WinEvent -LogName "Security" -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='NewProcessName']='C:\\Windows\\System32\\vssadmin.exe']]" -ErrorAction SilentlyContinue
if ($vssEvents) {
    Write-Host "[!] CRITICAL: vssadmin.exe execution detected (Shadow Copy Deletion):" -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[-] No vssadmin deletion attempts found in Security logs." -ForegroundColor Green
}

Write-Host "[+] Check complete. Review output." -ForegroundColor Cyan


---