PAYLOAD Ransomware Gang: Low-Volume Construction Targeting & Critical Firewall Vulnerability Exploitation

---
title: Potential Check Point IKEv1 Authentication Bypass
id: 6c7a4b1e-9a2b-4c0d-8e5f-1a2b3c4d5e6f
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 key exchange anomalies or failed authentication followed by immediate session establishment on Check Point Security Gateways.
status: experimental
author: Security Arsenal Intel
date: 2026/07/12
modified: 2026/07/12
logsource:
  product: firewall
  service: checkpoint
detection:
  selection:
    product|contains: 'Check Point'
    action: 'key-exchange'
    ike_version: 'v1'
  condition: selection
fields:
  - src_ip
  - dst_ip
  - user
  - status
falsepositives:
  - Legacy VPN client misconfigurations
level: high
---
title: Suspicious ConnectWise ScreenConnect Path Traversal
id: 7d8b5c2f-0b3c-5d1e-9f6a-2b3c4d5e6f7g
description: Detects attempts to exploit CVE-2024-1708 via path traversal strings in ScreenConnect web logs.
status: experimental
author: Security Arsenal Intel
date: 2026/07/12
modified: 2026/07/12
logsource:
  product: web server
  service: iis
detection:
  selection_uri:
    cs-uri-query|contains:
      - '..%2f'
      - '..\\'
  selection_host:
    cs-host|contains: 'ScreenConnect'
  condition: all of selection*
fields:
  - cs-ip
  - cs-uri-query
  - sc-status
falsepositives:
  - Unknown
level: critical
---
title: Cisco FMC Deserialization Anomaly
id: 8e9c6d3g-1c4d-6e2f-0a7b-3c4d5e6f7g8h
description: Identifies suspicious web requests to Cisco FMC management interfaces indicative of deserialization exploits (CVE-2026-20131).
status: experimental
author: Security Arsenal Intel
date: 2026/07/12
modified: 2026/07/12
logsource:
  product: cisco
  service: fmc
detection:
  selection:
    cisco_facility|contains: 'WEBUI'
    http_method|contains: 'POST'
    response_code: 200
  filter:
    src_ip|startswith:
      - '10.'
      - '192.168.'
  condition: selection and not filter
fields:
  - src_ip
  - dest_ip
  - url
falsepositives:
  - Legitimate administrative bulk updates
level: high

// Hunt for lateral movement and RMM exploitation indicative of PAYLOAD
let TimeFrame = 7d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Look for ScreenConnect binaries or renamed processes
| where (ProcessVersionInfoOriginalFileName =~ "ConnectWiseControl.Client.exe" or ProcessVersionInfoCompanyName =~ "ConnectWise")
// Look for command line arguments typical of path traversal or exploit execution
or ProcessCommandLine has "%2f" 
   or ProcessCommandLine has "..\\"
   or ProcessCommandLine has "Web.config"
// Correlate with network connections to known C2s or unusual ports
| join kind=leftouter (DeviceNetworkEvents
| where Timestamp > ago(TimeFrame) and (RemotePort == 8040 or RemotePort == 8041)) on DeviceId, InitiatingProcessAccountName
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteIP, RemotePort
| order by Timestamp desc

<#
.SYNOPSIS
    Rapid Response Check for Ransomware Staging and Firewall Integrity
.DESCRIPTION
    Checks for recent deletion of Volume Shadow Copies (VSS), enumerates 
    scheduled tasks created in the last 7 days (common persistence), and 
    checks for abnormal logins on Check Point/Cisco services if logs are available locally.
#>

Write-Host "[+] Starting PAYLOAD Ransomware Rapid Response Check..." -ForegroundColor Cyan

# 1. Check for VSS Deletion (Event ID 104 from VSS)
Write-Host "[*] Checking for Volume Shadow Copy deletions (Last 24h)..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=104; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($vssEvents) {
    Write-Host "[!] CRITICAL: VSS Deletion events detected!" -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[-] No VSS deletion events found." -ForegroundColor Green
}

# 2. Enumerate Scheduled Tasks created in last 7 days
Write-Host "[*] Checking for Scheduled Tasks created/modified in last 7 days..." -ForegroundColor Yellow
$suspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}
if ($suspiciousTasks) {
    Write-Host "[!] WARNING: Recently created/modified scheduled tasks found." -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author, Actions | Format-List
} else {
    Write-Host "[-] No recent suspicious scheduled tasks." -ForegroundColor Green
}

# 3. Check for recent RDP/VPN failures (Security Log)
Write-Host "[*] Checking for high volume of Audit Failures (4625)..." -ForegroundColor Yellow
$failures = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue | Measure-Object
if ($failures.Count -gt 50) {
    Write-Host "[!] WARNING: Brute force activity detected ($($failures.Count) failures in last hour)." -ForegroundColor Red
} else {
    Write-Host "[-] Brute force activity within normal thresholds." -ForegroundColor Green
}

Write-Host "[+] Check complete." -ForegroundColor Cyan


---