---
title: Potential Check Point IKEv1 Auth Bypass (CVE-2026-50751)
id: 8a2f1b3c-4d5e-6f78-9a0b-1c2d3e4f5a6b
description: Detects signs of exploitation attempts against Check Point Security Gateway IKEv1 vulnerability leading to improper authentication.
status: experimental
date: 2026/07/08
author: Security Arsenal Research
logsource:
  product: firewall
  service: check_point
detection:
  selection:
    action: 'accept' or 'decrypt' or 'key_install'
    protocol: 'ike'
    ike_version: '1'
    vendor_specific|contains: 'vpn_community'
  filter_legit:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate remote access VPN connections from known corporate ranges
level: high
tags:
  - attack.initial_access
  - cve.2026.50751
  - ransomware.krybit
---
title: ConnectWise ScreenConnect Path Traversal Exploit (CVE-2024-1708)
id: 9b3c2d4e-5e6f-7a8b-0c1d-2e3f4a5b6c7d
description: Detects path traversal patterns in ScreenConnect web logs indicative of authentication bypass.
status: experimental
date: 2026/07/08
author: Security Arsenal Research
logsource:
  product: web server
  service: iis or apache
detection:
  selection_uri:
    cs-uri-query|contains:
      - '..%2f'
      - '..\\'
      - '%2e%2e'
  selection_host:
    cs-host|contains:
      - 'screenconnect'
      - 'connectwise'
  condition: selection_uri and selection_host
falsepositives:
  - Scanner noise (though still suspicious)
level: critical
tags:
  - attack.initial_access
  - cve.2024.1708
  - attack.t1190
  - ransomware.krybit
---
title: Suspicious Cobalt Strike Process Injection Patterns
id: 1c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
description: Detects indicative process creation patterns often used by KRYBIT affiliates for lateral movement via Cobalt Strike.
status: experimental
date: 2026/07/08
author: Security Arsenal Research
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
  selection_cli:
    CommandLine|contains:
      - 'javascript:'
      - 'DllRegisterServer'
      - 'http://'
  condition: selection_img and selection_cli
falsepositives:
  - Rare administrative automation
level: high
tags:
  - attack.execution
  - attack.t1055
  - malware.cobalt_strike
  - ransomware.krybit


kql
// KRYBIT Lateral Movement Hunt - Microsoft Sentinel
// Looks for SMB creation patterns consistent with data staging prior to exfiltration
let TimeFrame = 1d;
let CommonStagingFolders = @"C:\Windows\Temp", @"C:\ProgramData", @"Public";
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
| where InitiatingProcessFileName in ("powershell.exe", "cmd.exe", "wmic.exe")
| where ProcessCommandLine has "copy" or ProcessCommandLine has "robocopy"
| where ProcessCommandLine has any(CommonStagingFolders)
| where ProcessCommandLine has ".zip" or ProcessCommandLine has ".rar" or ProcessCommandLine has ".7z"
| project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FolderPath
| extend RiskScore = 100
| order by Timestamp desc


powershell
# KRYBIT Rapid Response Hardening Script
# Actions: Checks for suspicious Scheduled Tasks (often used for persistence)
# and reviews recent Shadow Copy modifications (common precursor to encryption).

Write-Host "[+] Starting KRYBIT Rapid Response Checks..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 7 days with hidden actions
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($suspiciousTasks) {
    Write-Host "[!] ALERT: Found Scheduled Tasks modified/created in last 7 days:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author, Actions | Format-List
} else {
    Write-Host "[+] No suspicious recent scheduled tasks found." -ForegroundColor Green
}

# 2. Check for Shadow Copy Deletion attempts (via vssadmin or diskshadow)
$shadowCopyEvents = Get-WinEvent -LogName Application -FilterXPath "*[System[(EventID=1)]] and *[Data[@Name='Command'] and (contains(Data,'vssadmin') or contains(Data,'delete') or contains(Data,'shadow'))]" -ErrorAction SilentlyContinue
if ($shadowCopyEvents) {
    Write-Host "[!] ALERT: Evidence of Shadow Copy manipulation commands found!" -ForegroundColor Red
} else {
    Write-Host "[+] No explicit Shadow Copy deletion commands found in recent logs." -ForegroundColor Green
}

# 3. Audit Check Point VPN Logs (Requires Event Log forwarding or API access usually, placeholder for connectivity check)
Write-Host "[+] Recommendation: Verify Check Point Security Gateway logs for IKEv1 anomalies immediately related to CVE-2026-50751." -ForegroundColor Yellow

Write-Host "[+] Script Complete." -ForegroundColor Cyan


---

# Incident Response Priorities

Based on KRYBIT's historical playbook and the current CVE exploitation:

**T-Minus Detection Checklist:**
1.  **Check Point Logs:** Immediate review of VPN logs for IKEv1 connections resulting in authentication success without standard MFA prompts.
2.  **ScreenConnect Session Logs:** Audit for sessions initiated from anomalous IPs or the `Guest` user account (indication of CVE-2024-1708).
3.  **Exchange Server IIS Logs:** Look for `cmd.aspx` or similar shell upload artifacts related to CVE-2023-21529.

**Critical Assets for Exfiltration:**
KRYBIT historically prioritizes:
*   User databases (SQL dumps) for customer PII.
*   Intellectual property (CAD drawings, source code) from Technology sector victims.
*   Financial records and tax documents.

**Containment Actions (Urgency: High):**
1.  **Isolate:** Disconnect Check Point VPN interfaces and Cisco FMC management interfaces from the internet until patches are verified.
2.  **Block:** Block inbound traffic from Mexico, Bolivia, China, and Malaysia regions *if* no business exists there (Geo-blocking as temporary triage).
3.  **Credential Reset:** Force reset of local admin passwords on servers and Domain Admin accounts (assuming credential dumping occurred).

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch:** Apply patches for **CVE-2026-50751** (Check Point) and **CVE-2026-20131** (Cisco FMC) immediately. If patching is delayed, disable IKEv1 on Check Point gateways.
*   **Restrict Access:** Ensure ConnectWise ScreenConnect instances are behind a Zero Trust Network Access (ZTNA) gateway, not directly exposed to the public internet.

**Short-term (2 Weeks):**
*   **Architecture:** Implement a secure VPN access gateway that supports phishing-resistant MFA (FIDO2) to act as a jump server before reaching internal resources.
*   **Monitoring:** Deploy specific signatures for the Nx Console malicious code (CVE-2026-48027) and block execution of unsigned binaries from temp directories.

---