LOCKBIT5: Americas-Heavy Surge Targets Healthcare & Manufacturing — Critical CVEs Active

---
title: Potential LOCKBIT5 Exploitation of Cisco FMC (CVE-2026-20131)
id: 3b8a1c2d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
description: Detects potential deserialization exploitation attempts or suspicious web shell activity on Cisco FMC related to CVE-2026-20131.
status: experimental
author: Security Arsenal Research
date: 2026/04/17
tags:
    - attack.initial_access
    - cve.2026.20131
    - detection.emerging_threats
logsource:
    category: web
    product: apache
    # Or specific proxy/NGFW logs
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains:
            - '/mgmt/'
            - '/api/fmc_config'
        sc-status:
            - 200
            - 500
    filter:
        cs-user-agent|contains: 'Cisco'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative API usage
level: high

---
title: SmarterMail Authentication Bypass (CVE-2026-23760)
id: 9d8e7f6a-5b4c-3d2e-1f0a-9b8c7d6e5f4a
description: Detects authentication bypass attempts on SmarterMail via alternate paths or unusual success patterns from unknown IPs.
status: experimental
author: Security Arsenal Research
date: 2026/04/17
tags:
    - attack.initial_access
    - cve.2026.23760
    - attack.web_application_attack
logsource:
    category: webserver
    product: iis # SmarterMail often runs on IIS
detection:
    selection_uri:
        c-uri|contains:
            - '/LivePreview/'
            - '/Calendar/Event/'
            - '/mapi/'
    selection_method:
        cs-method: 'GET' or 'POST'
    condition: selection_uri and selection_method
falsepositives:
    - Legitimate plugin usage
level: critical

---
title: LOCKBIT5 Ransomware Process Execution Patterns
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects characteristic process execution chains used by LOCKBIT affiliates, including SharpHound, 7-Zip, and PsExec for lateral movement and exfiltration.
status: experimental
author: Security Arsenal Research
date: 2026/04/17
tags:
    - attack.execution
    - attack.lateral_movement
    - attack.collection
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        Image|endswith:
            - '\\7z.exe'
            - '\\powershell.exe'
            - '\\psexec.exe'
            - '\\psexec64.exe'
    selection_args:
        CommandLine|contains:
            - ' -a ' # 7z archiving
            - ' -p' # 7z password
            - 'Invoke-BloodHound'
            - ' -accepteula'
    condition: selection_tools and selection_args
falsepositives:
    - Administrative scripting
    - Legitimate backups
level: high

// Hunt for mass data staging and lateral movement indicative of pre-encryption activity
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Common tools used by LockBit affiliates for recon and movement
| where FileName in~ ("powershell.exe", "cmd.exe", "powershell_ise.exe", "wmic.exe", "psexec.exe", "psexec64.exe", "rundll32.exe")
// Suspicious arguments often used for disabling security or moving laterally
| where ProcessCommandLine has "Add-Persistence" 
   or ProcessCommandLine has "New-ItemProperty" 
   or ProcessCommandLine has "-Enc" 
   or ProcessCommandLine has "SCCM" 
   or ProcessCommandLine has "SharpHound"
// Check for parent processes often associated with ransomware droppers
| where InitiatingProcessFileName in~ ("mshta.exe", "wscript.exe", "cscript.exe", "winword.exe", "excel.exe")
| summarize count() by DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName
| order by count_ desc

<#
.SYNOPSIS
    LockBit5 Rapid Response Hardening & Detection Script
.DESCRIPTION
    Checks for recent suspicious scheduled tasks (persistence) and validates
    Volume Shadow Copy Service (VSS) status. LOCKBIT5 is known to delete VSS.
#>

Write-Host "[+] Starting LockBit5 Rapid Response Checks..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 7 days
Write-Host "[!] Checking for Scheduled Tasks created in last 7 days..." -ForegroundColor Yellow
$cutoffDate = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $taskInfo = Get-ScheduledTaskInfo -TaskName $_.TaskName -TaskPath $_.TaskPath
    if ($taskInfo.LastRunTime -gt $cutoffDate -or $_.Date -gt $cutoffDate) {
        Write-Host "SUSPICIOUS TASK FOUND: $($_.TaskName) | Path: $($_.TaskPath) | Last Run: $($taskInfo.LastRunTime)" -ForegroundColor Red
    }
}

# 2. Check Volume Shadow Copy Status
Write-Host "[!] Checking Volume Shadow Copy (VSS) health..." -ForegroundColor Yellow
try {
    $vss = Get-WmiObject -Class Win32_ShadowCopy
    if ($vss.Count -eq 0) {
        Write-Host "CRITICAL: No Shadow Copies found. This is a common post-exploitation step for LockBit." -ForegroundColor Red
    } else {
        Write-Host "INFO: $($vss.Count) Shadow Copies found. Newest: $($vss[0].InstallDate)" -ForegroundColor Green
    }
} catch {
    Write-Host "ERROR: Could not query VSS." -ForegroundColor Red
}

# 3. Audit Recent RDP Connections (Last 24h)
Write-Host "[!] Auditing RDP Connections (Last 24h)..." -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddHours(-24)} | 
Where-Object {$_.Message -match 'Logon Type:\s+10' -and $_.Message -notmatch 'Source Network Address:\s+-'} |
Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='IP';e={$_.Properties[19].Value}} | Format-Table

Write-Host "[+] Check Complete." -ForegroundColor Cyan


---