---
title: Potential ScreenConnect Path Traversal Exploitation (CVE-2024-1708)
id: a1b2c3d4-5e6f-7g8h-9i0j-1k2l3m4n5o6p
description: Detects potential exploitation of CVE-2024-1708 in ConnectWise ScreenConnect via suspicious URI patterns often used by ransomware gangs like KILLSEC.
status: experimental
date: 2026/07/25
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
logsource:
    category: web
    product: apache
    service: access
detection:
    selection:
        c-uri|contains:
            - '/Bin/ScreenConnect.ashx'
            - '%2fBin%2fScreenConnect.ashx'
        c-uri-query|contains:
            - 'SessionId='
            - 'Host='
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high
---
title: Check Point VPN IKEv1 Authentication Anomaly (CVE-2026-50751)
id: b2c3d4e5-6f7g-8h9i-0j1k-2l3m4n5o6p7q
description: Detects indicators of CVE-2026-50751 exploitation involving improper authentication in IKEv1 key exchange on Check Point Security Gateways.
status: experimental
date: 2026/07/25
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
logsource:
    product: checkpoint
    service: vpn
detection:
    selection:
        ike_version: 'v1'
        event_type: 'key_exchange'
        auth_status|endswith: 'failure'
    filter:
        src_ip:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
    condition: selection and not filter
falsepositives:
    - Misconfigured VPN clients
level: high
---
title: Suspicious Exchange Server Deserialization Activity (CVE-2023-21529)
id: c3d4e5f6-7g8h-9i0j-1k2l-3m4n5o6p7q8r
description: Detects exploitation attempts of CVE-2023-21529 involving deserialization of untrusted data in Microsoft Exchange Server, a known vector for ransomware initial access.
status: experimental
date: 2026/07/25
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ShareName|contains: 'Exchange'
        RelativeTargetName|contains: '.dll'
    condition: selection
falsepositives:
    - Legitimate Exchange maintenance
level: high

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("rclone.exe", "powershell.exe", "cmd.exe", "robocopy.exe")
| where ProcessCommandLine has_any ("sync", "copy", "/b", ":\$Recycle.Bin", "/MIR")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend FullPath = strcat(DeviceName, " - ", AccountName)
| summarize count() by FullPath, FileName, bin(Timestamp, 5m)
| where count_ > 5

# Check for Scheduled Tasks created in the last 3 days
$Date = (Get-Date).AddDays(-3)
Get-ScheduledTask | Where-Object {$_.Date -gt $Date} | Select-Object TaskName, TaskPath, State, Date

# Check for Volume Shadow Copy Deletion attempts via vssadmin
Write-Host "Checking for vssadmin delete shadows events..."
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=$Date} -ErrorAction SilentlyContinue | 
Where-Object {$_.Message -match 'vssadmin.exe' -and $_.Message -match 'delete'} | 
Select-Object TimeCreated, Message


---

# Incident Response Priorities

**T-minus Detection Checklist:**
1.  **VPN Logs:** Audit Check Point and Cisco Firewalls for bursts of failed IKEv1 authentication attempts or successful logins from anomalous geolocations (CIS Region IN/US correlation).
2.  **Web Shells:** Scan for `ScreenConnect.ashx` anomalies or unexpected web directory modifications on public-facing IIS/Apache servers.
3.  **Lateral Movement:** Hunt for `PsExec` or `WMI` execution patterns originating from non-admin workstation IPs.

**Critical Assets for Exfiltration:**
Based on the current victim profile, prioritize the containment of:
*   **Financial:** Transaction databases, ACH transfer logs, customer PII.
*   **Healthcare:** Patient EMRs, insurance billing records (origins ivf).

**Containment Actions:**
1.  **Isolate:** Immediately disconnect VPN concentrators and ScreenConnect servers from the internal network if compromise is suspected.
2.  **Revoke:** Reset credentials for all privileged accounts that have logged into the exposed edge devices in the last 30 days.
3.  **Block:** Sinkhole known C2 IPs associated with KILLSEC Cobalt Strike beacons.

---

# Hardening Recommendations

**Immediate (24h):**
*   **Patch:** Apply patches for **CVE-2024-1708 (ConnectWise)** and **CVE-2026-50751 (Check Point)** immediately. These are the active access vectors.
*   **MFA:** Enforce MFA on all VPN and remote desktop gateways.
*   **Disable:** If patching is not possible, temporarily disable external access to ScreenConnect web interfaces and switch to VPN-only access.

**Short-term (2 weeks):**
*   **Network Segmentation:** Segment critical finance and healthcare databases from the general user network to limit lateral movement.
*   **EDR Deployment:** Ensure EDR sensors are active on all edge management servers and DMZs.

---