PLAY Ransomware Gang: Construction & Finance Sector Surge — Firewall & Remote Access Exploitation

---
title: Potential ConnectWise ScreenConnect Authentication Bypass
id: 8e54b0d6-3a5c-4d5e-9f2a-1b7d8e9c0a1b
status: experimental
description: Detects potential exploitation of CVE-2024-1708 involving path traversal in ScreenConnect web requests.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/05
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware.play
logsource:
    category: webserver
    product: null
detection:
    selection:
        cs-uri-query|contains:
            - '/Guest.'
            - '../'
        c-uri|contains: 
            - 'SetupWizard'
            - 'Login'
    condition: selection
falsepositives:
    - Unusual but legitimate administrative access
level: critical
---
title: Suspicious PowerShell Deserialization via Exchange or Cisco Management
id: f4c3e2d1-0b9a-4c5d-8e1f-2a3b4c5d6e7f
status: experimental
description: Detects suspicious PowerShell execution patterns often associated with deserialization exploits (CVE-2023-21529, CVE-2026-20131) used by PLAY for initial access or lateral movement.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/05
tags:
    - attack.execution
    - attack.t1059.001
    - ransomware.play
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: 
            - '\powershell.exe'
            - '\pwsh.exe'
        ParentProcessName|contains:
            - '\w3wp.exe' # IIS/Exchange
            - '\java.exe'  # Cisco FMC/Management consoles often Java-based
    filter_legit:
        SubjectUserName: 
            - 'SYSTEM'
            - 'NETWORK SERVICE'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administration via management consoles
level: high
---
title: PLAY Ransomware Lateral Movement via PsExec or WMI
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects lateral movement indicators commonly used by PLAY group, specifically PsExec and WMI command line execution.
references:
    - Internal Play Ransomware Telemetry
author: Security Arsenal Research
date: 2026/07/05
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
logsource:
    product: windows
    service: security
detection:
    selection_psexec:
        EventID: 4688
        NewProcessName|contains: '\psexec.exe'
        CommandLine|contains: 
            - '-accepteula'
            - '\\'
    selection_wmi:
        EventID: 4688
        NewProcessName|endswith: '\wmiprvse.exe'
        ParentProcessName|endswith: '\svchost.exe'
    condition: 1 of selection*
falsepositives:
    - Administrative IT tasks
level: medium

// Hunt for PLAY staging and lateral movement activities
// Focuses on rare process executions and network connections associated with their tooling
let TimeFrame = 1d;
let ProcessCreation = 
    SecurityEvent
    | where TimeGenerated > ago(TimeFrame)
    | where EventID == 4688
    | project TimeGenerated, Computer, Account, SubjectUserName, NewProcessName, CommandLine, ParentProcessName;
let SuspiciousProcesses = 
    ProcessCreation
    | where NewProcessName in~ ("C:\\Windows\\System32\\powershell.exe", "C:\\Windows\\System32\\cmd.exe", "C:\\Windows\\System32\\wbem\\wmiprvse.exe")
    | extend EncodedScript = extract(@"-Enc(?:odedCommand)?\s+([A-Za-z0-9+/=]+)", 1, CommandLine)
    | where isnotempty(EncodedScript);
let NetworkConnections = 
    DeviceNetworkEvents
    | where TimeGenerated > ago(TimeFrame)
    | where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
    | summarize count() by DeviceName, InitiatingProcessFileName, RemoteUrl, RemotePort;
SuspiciousProcesses
| join kind=leftouter NetworkConnections on $left.Computer == $right.DeviceName
| project TimeGenerated, Computer, Account, CommandLine, RemoteUrl, RemotePort
| order by TimeGenerated desc

<#
.SYNOPSIS
    PLAY Ransomware Rapid Response Script
.DESCRIPTION
    Checks for indicators of PLAY ransomware staging: Scheduled Tasks, recent Shadow Copy manipulation,
    and unusual SMB connections.
#>

Write-Host "[+] Starting PLAY Ransomware Rapid Response Check..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 7 days (Common persistence)
Write-Host "[*] Checking for Scheduled Tasks created/modified in last 7 days..." -ForegroundColor Yellow
$schTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}
if ($schTasks) {
    Write-Host "[!] ALERT: Found suspicious/recent scheduled tasks:" -ForegroundColor Red
    $schTasks | Select-Object TaskName, Date, Author | Format-Table -AutoSize
} else {
    Write-Host "[-] No suspicious tasks found." -ForegroundColor Green
}

# 2. Check for Shadow Copy Deletion Attempts (VssAdmin)
Write-Host "[*] Checking Event Logs for vssadmin delete shadow commands..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | 
              Where-Object {$_.Message -match 'vssadmin.exe' -and $_.Message -match 'delete'}
if ($vssEvents) {
    Write-Host "[!] ALERT: Potential Shadow Copy deletion detected." -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[-] No Shadow Copy deletion attempts found." -ForegroundColor Green
}

# 3. Check for unusual processes (Play often uses tools like Advanced IP Scanner or SoftPerfect)
Write-Host "[*] Checking for reconnaissance tools in running processes..." -ForegroundColor Yellow
$proclist = @("advanced_ip_scanner", "softperfect", "netscan", "masscan")
$foundProcs = Get-Process | Where-Object {$proclist -like "*$($_.ProcessName)*"}
if ($foundProcs) {
    Write-Host "[!] ALERT: Suspicious reconnaissance tool running:" -ForegroundColor Red
    $foundProcs | Select-Object ProcessName, Id, Path | Format-Table -AutoSize
} else {
    Write-Host "[-] No known recon tools detected." -ForegroundColor Green
}

Write-Host "[+] Scan complete." -ForegroundColor Cyan


---