---
title: Potential Check Point VPN Gateway Exploitation Attempt
description: Detects potential exploitation of CVE-2026-50751 involving improper authentication in IKEv1 key exchange or anomalies in VPN logs indicative of bypass.
author: Security Arsenal Research
date: 2026/06/21
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: firewall
detection:
    selection:
        action|contains: 'deny'
        destination_port: 500
        protocol: 'udp'
        src_ip|startswith:
            - '10.' # Internal IP often spoofed or used in relay
    condition: selection
falsepositives:
    - Legitimate misconfigured VPN clients
level: high
tags:
    - cve.2026.50751
    - attack.initial_access
    - ransomware.lockbit5
---
title: Suspicious ConnectWise ScreenConnect Path Traversal
id: 8c30a0e4-7402-4a6c-9b1a-7e4e5e0c5c1a
description: Detects path traversal strings commonly associated with CVE-2024-1708 exploitation in ScreenConnect web logs.
author: Security Arsenal Research
date: 2026/06/21
status: stable
logsource:
    category: web
    product: connectwise
detection:
    selection_uri:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '%2e%2e'
    selection_ext:
        cs-uri-query|contains:
            - '.aspx'
            - '.ashx'
    condition: selection_uri and selection_ext
falsepositives:
    - Unknown
level: critical
tags:
    - cve.2024.1708
    - attack.initial_access
    - attack.t1190
    - ransomware.lockbit5
---
title: LockBit5 Lateral Movement via PsExec and WMI
description: Detects typical LockBit5 behavior of using PsExec or WMI for lateral movement to spread ransomware binaries.
author: Security Arsenal Research
date: 2026/06/21
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        ParentImage|endswith: '\psexec.exe'
        CommandLine|contains: \
            - '-accepteula'
            - '\\'
    selection_wmi:
        ParentImage|endswith: '\wmiprvse.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
    condition: 1 of selection*
falsepositives:
    - Administrative IT tasks
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - ransomware.lockbit5

let TimeFrame = 1d;
// Hunt for large volumes of data copied to staging locations or unusual access patterns
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ ('powershell.exe', 'cmd.exe', 'robocopy.exe', 'rar.exe', '7z.exe')
| where ProcessCommandLine has any ('System32', 'SysWOW64', 'cmd /c', 'copy ')
| summarize count(), make_set(ProcessCommandLine) by DeviceName, AccountName, FileName
| where count_ > 5 // Threshold for aggressive automation
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(TimeFrame)
    | where RemotePort in (445, 135, 139, 3389) // Common SMB/RDP ports used for lateral spread
    | summarize make_set(RemoteIP) by DeviceName
) on DeviceName

# LockBit5 Rapid Response Indicator Check
# Requires Administrator Privileges

Write-Host "[+] Checking for Recently Created Scheduled Tasks (Last 7 Days)..." -ForegroundColor Cyan
$dateCutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $dateCutoff} | ForEach-Object {
    $taskInfo = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath
    if ($taskInfo -match "powershell" -or $taskInfo -match "cmd" -or $taskInfo -match "http") {
        Write-Host "[!] Suspicious Task Found: $($_.TaskName)" -ForegroundColor Red
        Write-Host $taskInfo -ForegroundColor DarkGray
    }
}

Write-Host "[+] Checking Volume Shadow Copy Status..." -ForegroundColor Cyan
try {
    $vss = Get-WmiObject -Class Win32_ShadowCopy -ErrorAction Stop
    if ($vss.Count -eq 0) {
        Write-Host "[CRITICAL] No Volume Shadow Copies found. Possible deletion event." -ForegroundColor Red
    } else {
        Write-Host "[INFO] $($vss.Count) Shadow Copies exist." -ForegroundColor Green
    }
} catch {
    Write-Host "[ERROR] Could not query VSS." -ForegroundColor Yellow
}

Write-Host "[+] Checking for common Ransomware Extensions in User Profile..." -ForegroundColor Cyan
$paths = @("$env:USERPROFILE\Documents", "$env:USERPROFILE\Desktop", "C:\")
$extensions = @(".lockbit", ".encrypted", ".hl0k2j", ".abcd")
foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include $extensions -ErrorAction SilentlyContinue | Select-Object -First 5 FullName | ForEach-Object {
            Write-Host "[!] ENCRYPTED FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }
}


---

# Incident Response Priorities

**T-Minus Detection Checklist (Pre-Encryption):**
1.  **Perimeter Log Audit:** Immediate review of Check Point and Cisco firewall logs for indicators of CVE-2026-50751 or CVE-2026-20131 exploitation (unsuccessful IKEv1 auth attempts, anomalous admin logins).
2.  **Remote Desktop Hygiene:** Scan for unauthorized RDP sessions. LockBit5 heavily relies on RDP for manual hands-on-keyboard movement.
3.  **Process Anomalies:** Hunt for `powershell.exe` spawning from `svchost.exe` or unexpected parent processes, a hallmark of webshell exploitation.

**Critical Assets at Risk:**
*   **Active Directory:** Domain Controllers are primary targets for credential dumping (Mimikatz) to facilitate lateral movement.
*   **Backups:** LockBit5 specifically seeks out and deletes or encrypts Volume Shadow Copies (VSS) and network-based backups (NAS/SAN).
*   **Intellectual Property:** Design documents in Manufacturing and patient records in Healthcare are prioritized for exfiltration.

**Containment Actions:**
1.  **Isolate:** Segment the VLAN of any suspected victim machine immediately.
2.  **Disable Accounts:** Disable service accounts associated with Check Point/Cisco management if compromise is suspected.
3.  **Power Down:** If encryption is actively observed (file extensions changing), power off the machine physically to prevent spread to network shares.

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch Critical Perimeter:** Apply the patch for **CVE-2026-50751 (Check Point)** and **CVE-2026-20131 (Cisco FMC)** immediately. These are active gates for this campaign.
*   **Block RDP from Internet:** Enforce a strict VPN requirement (MFA enforced) for all remote access; block TCP 3389 from the internet.
*   **MFA for Everything:** Ensure MFA is enabled for VPNs, email, and especially firewall management interfaces.

**Short-term (2 Weeks):**
*   **Network Segmentation:** Implement Zero Trust principles. Separate critical backup infrastructure from the main corporate LAN.
*   **EDR Deployment:** Ensure EDR agents are deployed on all perimeter servers and Domain Controllers with behavioral monitoring for ransomware.

---