title: Potential Check Point Security Gateway IKEv1 Exploitation (CVE-2026-50751)
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential exploitation of CVE-2026-50751 involving improper authentication in IKEv1 key exchange on Check Point gateways.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/25
logsource:
    product: checkpoint
    service: vpn
detection:
    selection:
        vpn_message|contains:
            - 'IKEv1'
            - 'authentication failure'
            - 'payload too large'
    filter_legit:
        src_ip:
            - '192.168.0.0/16'
            - '10.0.0.0/8'
    condition: selection and not filter_legit
falsepositives:
    - Misconfigured VPN clients
level: high
---
title: ConnectWise ScreenConnect Path Traversal Exploitation (CVE-2024-1708)
id: b2c3d4e5-6789-01ab-cdef-234567890abc
status: experimental
description: Detects suspicious URI patterns associated with CVE-2024-1708 exploitation attempts on ScreenConnect servers.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/25
logsource:
    category: web
    product: apache
detection:
    selection_uri:
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '%2fbin%2fsh'
    selection_endpoint:
        cs-uri-stem|contains:
            - '/LiveEvents.ashx'
            - '/Handler.ashx'
    condition: selection_uri and selection_endpoint
falsepositives:
    - Rare scanning traffic
level: critical
---
title: Ransomware Activity - Volume Shadow Copy Deletion
id: c3d4e5f6-7890-12ab-cdef-345678901bcd
status: experimental
description: Detects attempts to delete Volume Shadow Copies using vssadmin or wbadmin, a common precursor to encryption by MONEYMESSAGE.
author: Security Arsenal
date: 2026/07/25
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    condition: 1 of selection*
falsepositives:
    - System administration scripts
level: critical

// Hunt for lateral movement and data staging associated with MONEYMESSAGE
// Looks for PsExec usage, WMI remote process creation, and large data transfers
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("psexec.exe", "psexec64.exe", "wmic.exe")
    or ProcessCommandLine has "Invoke-WmiMethod" 
| extend HostName = DeviceName
| join kind=inner (DeviceNetworkEvents 
    | where Timestamp > ago(7d) 
    | where RemotePort == 445 or RemotePort == 139 
    | where SentBytes > 10485760 // > 10MB transfer potential exfil
) on DeviceId
| project Timestamp, HostName, InitiatingProcessFileName, ProcessCommandLine, RemoteIP, RemoteUrl, SentBytes
| order by Timestamp desc

<#
.SYNOPSIS
    Rapid Response Check for MONEYMESSAGE Indicators of Compromise
.DESCRIPTION
    Checks for recent VSS deletions, unusual scheduled tasks, and open RDP connections.
#>

Write-Host "[+] Starting MONEYMESSAGE IOC Hunt..." -ForegroundColor Cyan

# 1. Check for VSS Deletion events (Event ID 7036 for Service Stop or specific VSS admin logs)
Write-Host "\n[*] Checking for Volume Shadow Copy manipulation..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -LogName Application -FilterXPath "*[System[(EventID=7036)]] and *[EventData[Data='VSS'] and [Data='stopped']]]" -ErrorAction SilentlyContinue -MaxEvents 20
if ($vssEvents) { Write-Host "[ALERT] VSS Service stop events found recently." -ForegroundColor Red }

# 2. Check for Scheduled Tasks created in last 48 hours (Common persistence)
Write-Host "\n[*] Checking for Scheduled Tasks created/modified in last 48h..." -ForegroundColor Yellow
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddHours(-48) }
if ($suspiciousTasks) { 
    Write-Host "[ALERT] Recent Scheduled Tasks found:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author | Format-Table
}

# 3. Check for active RDP sessions (Lateral Movement)
Write-Host "\n[*] Checking for active RDP sessions..." -ForegroundColor Yellow
$query = "query user"
$rdpUsers = cmd /c $query
if ($rdpUsers -match "Disc" -or $rdpUsers.Length -gt 2) {
    Write-Host "[ALERT] Active RDP sessions detected:" -ForegroundColor Red
    $rdpUsers
}

Write-Host "\n[+] Hunt Complete. If alerts triggered, isolate host immediately." -ForegroundColor Green


---

# Incident Response Priorities

**T-Minus Detection Checklist:**
1.  **Perimeter Log Review:** Immediately search Check Point and Cisco FMC logs for spikes in IKEv1 failures or deserialization errors against management interfaces.
2.  **ScreenConnect Audit:** Identify all instances of ConnectWise ScreenConnect. Review logs for failed logins followed by immediate success (Pass-the-Hash or Session Hijacking).
3.  **Process Anomalies:** Hunt for `powershell.exe` spawned by `svchost.exe` or web server services (`httpd.exe`, `tomcat.exe`) — indicative of web shell execution from CVE-2026-20131.

**Critical Assets for Exfiltration:**
*   **Transportation:** Customer manifests, driver logs (PII), route planning databases.
*   **Energy:** SCADA configuration files, O&M documentation, billing/customer data.

**Containment Actions (Ordered by Urgency):**
1.  **Isolate VPN Concentrators:** If using Check Point or Cisco VPNs, require MFA push for all re-authentications and block non-US IPs immediately.
2.  **Disable ScreenConnect:** Temporarily shut down remote access tools until patched (CVE-2024-1708).
3.  **Segment SCADA/OT:** Ensure air-gaps are intact; disconnect OT management servers from the corporate IT network if lateral movement is suspected.

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch Management:** Apply patches for **CVE-2026-50751 (Check Point)** and **CVE-2026-20131 (Cisco FMC)** immediately. These are the primary entry vectors for this campaign.
*   **Block Internet-Exposed Management Interfaces:** Ensure Cisco FMC and Check Point management consoles are not accessible from the internet; enforce VPN access to management subnets.
*   **ScreenConnect Hardening:** If patching is delayed, implement strict IP whitelisting for ScreenConnect instances.

**Short-Term (2 Weeks):**
*   **Network Segmentation:** Implement strict Zero Trust controls between IT and OT networks, specifically blocking RDP and SMB from the internet.
*   **MFA Enforcement:** Enforce phishing-resistant MFA (FIDO2) for all VPN and remote access entry points.
*   **EDR Coverage:** Ensure EDR agents are deployed on all management servers and jump hosts, not just end-user workstations.

---