title: Potential ScreenConnect Path Traversal Exploit CVE-2024-1708
id: 4a8f1234-5678-89ab-cdef-1234567890ab
description: Detects suspicious URI patterns associated with ConnectWise ScreenConnect authentication bypass and path traversal vulnerabilities.
status: experimental
date: 2026/07/17
author: Security Arsenal Research
logsource:
  category: webserver
detection:
  selection:
    cs-method|contains: 'GET'
    cs-uri-query|contains:
      - '/Bin/'
      - '.aspx?'
      - 'Login='
  filter:
    cs-uri-query|contains: 'Host='
  condition: selection and filter
falsepositives:
  - Legitimate administrative access via ScreenConnect
level: high
tags:
  - attack.initial_access
  - cve.2024.1708
  - ransomware.krybit

---
title: Check Point VPN IKEv1 Anomaly Detection
id: b8f92345-6789-01cd-ef12-345678901234
description: Detects IKEv1 key exchange initiation which may indicate exploitation attempts against CVE-2026-50751.
status: experimental
date: 2026/07/17
author: Security Arsenal Research
logsource:
  product: firewall
detection:
  selection:
    protocol|contains: 'IKE'
    version|contains: 'v1'
  condition: selection
falsepositives:
  - Legacy VPN configurations requiring IKEv1
level: medium
tags:
  - attack.initial_access
  - cve.2026.50751
  - ransomware.krybit

---
title: Microsoft Exchange Deserialization Activity
id: c0a03456-7890-12de-f234-567890123456
description: Detects PowerShell command lines associated with Exchange management that may indicate exploitation of CVE-2023-21529.
status: experimental
date: 2026/07/17
author: Security Arsenal Research
logsource:
  product: windows
  service: powershell
detection:
  selection:
    CommandLine|contains:
      - 'Microsoft.Exchange.Management'
      - 'New-ManagementRoleAssignment'
  filter:
    User|contains:
      - 'SYSTEM'
      - 'ADMIN' # Adjust to legitimate admin users
  condition: selection and not filter
falsepositives:
  - Legitimate Exchange Administration
level: high
tags:
  - attack.initial_access
  - cve.2023.21529
  - ransomware.krybit

// Hunt for lateral movement and credential dumping often preceding KRYBIT encryption
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("psexec.exe", "psexec64.exe", "wmic.exe", "powershell.exe")
| where ProcessCommandLine has_any ("node", "credential", "invoke-expression", "downloadstring", "iex")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

# KRYBIT Incident Response - Quick Triage
# Checks for recent scheduled tasks (persistence) and Volume Shadow Copy manipulation

Write-Host "[+] Checking for Scheduled Tasks created in last 24 hours..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddHours(-24)} | Select TaskName, TaskPath, Date, Author

Write-Host "[+] Checking for VSS Shadow Copy deletions (Event ID 5145 or 98 with 0x800043)..." -ForegroundColor Cyan
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=12345} -ErrorAction SilentlyContinue
if ($VssEvents) { $VssEvents | Select TimeCreated, Message | Format-List } else { Write-Host "No explicit VSS deletion events found in standard log." }

Write-Host "[+] Checking for unusual PowerShell process chains..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 100 -ErrorAction SilentlyContinue |
Where-Object {$_.Message -match 'powershell.exe' -and $_.Message -match '-EncodedCommand'} |
Select TimeCreated, Message | Format-List


---

# Incident Response Priorities

**T-Minus Detection Checklist:**
1. **Hunt for Web Shells:** Check IIS/Apache logs for the `2026-07-17` timeframe for anomalous `POST` requests containing `%2e%2e` (path traversal) or unusual user-agents.
2. **RMM Audit:** immediately audit ConnectWise ScreenConnect logs for successful logins from unknown IPs or privilege escalations.
3. **Perimeter Review:** Check Check Point firewall logs for IKEv1 connections that resulted in user authentication.

**Critical Assets:**
KRYBIT prioritizes exfiltrating:
- **Patient Records:** (PHI) for high extortion leverage.
- **Financial Databases:** Accounting and payroll data.
- **Employee PII:** For secondary phishing or identity fraud operations.

**Containment Actions:**
1. **Isolate:** Disconnect identified victims from the network immediately; do not power off (preserve memory).
2. **Block IPs:** Block all IP addresses interacting with the leaked CVE endpoints (Check Point, ScreenConnect) at the perimeter.
3. **Credential Reset:** Force reset of all privileged admin accounts, especially those used for Exchange and Firewall management.

---

# Hardening Recommendations

**Immediate (24h):**
- **Patch Critical CVEs:** Apply patches for **CVE-2024-1708 (ScreenConnect)** and **CVE-2026-50751 (Check Point)** immediately. If patching is delayed, disable ScreenConnect web interface access from the internet and disable IKEv1 on Check Point gateways.
- **MFA Enforcement:** Ensure all VPN and RMM access requires hardware-token MFA (FIDO2).

**Short-term (2 weeks):**
- **Network Segmentation:** Ensure healthcare and business services segments are strictly separated from the management plane.
- **Audit External Attack Surface:** Conduct a scan for all perimeter devices exposing VPN or RMM services to the public internet.