---
title: Potential Check Point Security Gateway Exploitation - CVE-2026-50751
id: 8a7b6c5d-4e3f-2a1b-9c8d-7e6f5a4b3c2d
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 improper authentication or unusual VPN session spikes.
status: experimental
author: Security Arsenal Intel
date: 2026/07/23
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: check_point
detection:
    selection:
        action|contains: 'accept' 
        service: 'ike'
       IKE_version: 'v1'
    filter:
        src_ip|startswith:
            - '10.'
            - '192.168.'
    condition: selection and not filter | count(src_ip) > 50
falsepositives:
    - Legitimate high-volume VPN usage from single IPs
level: high
tags:
    - cve.2026.50751
    - attack.initial_access
    - nova.ransomware
---
title: Suspicious ConnectWise ScreenConnect Path Traversal Activity
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects potential path traversal exploitation attempts in ConnectWise ScreenConnect (CVE-2024-1708) often used for web shell upload.
status: experimental
author: Security Arsenal Intel
date: 2026/07/23
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5156
        DestPort: 8040 or 8041
        LayerName: 'AppContainer'
    filter Legitimate Traffic:
        SourceIp|startswith:
            - '192.168.'
            - '10.'
    condition: selection and not filter
level: high
tags:
    - cve.2024.1708
    - attack.initial_access
    - attack.execution
    - nova.ransomware
---
title: Ransomware Pre-Encryption Volume Shadow Copy Deletion
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
description: Detects commands used to delete Volume Shadow Copies (VSS) which is a common step in ransomware playbooks to prevent recovery.
status: experimental
author: Security Arsenal Intel
date: 2026/07/23
logsource:
    product: windows
    process_creation:
    detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    condition: selection
falsepositives:
    - System administration tasks
level: critical
tags:
    - attack.impact
    - nova.ransomware

// Hunt for lateral movement and data staging associated with NOVA activity
// Focuses on PsExec, WMI, and massive file modifications
let TimeFrame = 1d;
let ProcessCreation = union DeviceProcessEvents, SecurityEvent
| where Timestamp > ago(TimeFrame)
| where ProcessName has_any ('psexec.exe', 'wmic.exe', 'powershell.exe')
| where CommandLine has_any ('-encodedCommand', 'New-Object', 'Invoke-Expression')
| project Timestamp, DeviceName, AccountName, ProcessName, CommandLine, InitiatingProcessFileName;
let FileEvents = DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| where ActionType == 'FileCreated'
| where FileName !~ '.tmp' // reduce noise
| summarize FileCount = count() by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 5m)
| where FileCount > 50; // Threshold for mass staging
ProcessEvents
| join kind=inner FileEvents on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessName, CommandLine, FileCount
| order by Timestamp desc

<#
.SYNOPSIS
    Rapid Response Hardening Script for NOVA Indicators.
.DESCRIPTION
    Checks for exposed RDP, unusual Scheduled Tasks, and VSS deletion attempts.
    Run as Administrator.
#>

Write-Host "[+] Starting NOVA Ransomware Rapid Response Check..." -ForegroundColor Cyan

# 1. Check for recent Scheduled Tasks (Persistence check)
Write-Host "\n[*] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
$DateCutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $DateCutoff} | Select-Object TaskName, TaskPath, Date, Author

# 2. Check VSS Service Status and Recent Events (Recovery check)
Write-Host "\n[*] Checking Volume Shadow Copy Service Status..." -ForegroundColor Yellow
$vss = Get-Service -Name VSS
if ($vss.Status -ne 'Running') {
    Write-Host "[ALERT] VSS Service is not running! It is currently: $($vss.Status)" -ForegroundColor Red
} else {
    Write-Host "[OK] VSS Service is Running." -ForegroundColor Green
}

# 3. Check Event Logs for vssadmin.exe deletion commands (Execution check)
Write-Host "\n[*] Checking Security Event Logs for vssadmin deletion attempts..." -ForegroundColor Yellow
$Events = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='NewProcessName']='C:\\Windows\\System32\\vssadmin.exe']]" -ErrorAction SilentlyContinue
if ($Events) {
    foreach ($e in $Events) {
        $cmdLine = $e.Properties[8].Value
        if ($cmdLine -match "delete shadows") {
            Write-Host "[CRITICAL] Found VSS Deletion command at $($e.TimeCreated): $cmdLine" -ForegroundColor Red
        }
    }
} else {
    Write-Host "[OK] No vssadmin deletion events found." -ForegroundColor Green
}

Write-Host "\n[+] Check Complete." -ForegroundColor Cyan


---

# Incident Response Priorities

**T-Minus Detection Checklist:**
1.  **VPN/Firewall Logs:** Review logs for **Check Point** and **Cisco FMC** anomalies. Look for failed IKEv1 handshakes followed by success (indicator of auth bypass).
2.  **Remote Access Tools:** Audit **ConnectWise ScreenConnect** logs for path traversal strings (e.g., `%2e%2e%2f`) or unauthorized web session creation.
3.  **PowerShell Auditing:** Hunt for encoded commands or `Invoke-Expression` usage originating from non-admin accounts.

**Critical Assets at Risk:**
*   **Technology Sector:** Source code repositories, SSH keys, AWS/Azure credential files, IP.
*   **Financial Sector:** Customer PII databases, transaction logs, SWIFT endpoints.

**Containment Actions (Ordered by Urgency):**
1.  **Disconnect:** Immediately isolate victims identified in the leak site (Lintasarta, Canal 9, etc.) from the network if they are partners/vendors.
2.  **Patch:** Apply patches for **CVE-2026-50751** and **CVE-2026-20131** to internet-facing gateways immediately.
3.  **Block IPs:** Block IP ranges associated with NOVA infrastructure (check Threat Intel feeds for known NOVA C2s).
4.  **Credential Reset:** Force reset of passwords for all service accounts used by VPN and RMM tools.

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch Critical CVEs:** Update Check Point Security Gateway, Cisco Secure Firewall FMC, and ConnectWise ScreenConnect to the latest patched versions.
*   **Disable IKEv1:** If not required, disable IKEv1 on VPN gateways immediately to mitigate CVE-2026-50751.
*   **MFA Enforcement:** Enforce MFA on all VPN and RMM (ScreenConnect) access points.

**Short-Term (2 Weeks):**
*   **Network Segmentation:** Ensure RMM and VPN management interfaces are not accessible from the public internet without strict ACLs or a Zero Trust Network Access (ZTNA) solution.
*   **Audit Remote Tools:** Conduct an audit of all remote access tools (ScreenConnect, AnyDesk, RDP) exposed to the internet and remove or secure them.

---