title: Potential Check Point Security Gateway Exploitation CVE-2026-50751
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
description: Detects potential exploitation attempts of CVE-2026-50751 involving IKEv1 key exchange anomalies or authentication bypass patterns on Check Point Security Gateways.
status: experimental
date: 2026/06/13
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: check_point
detection:
    selection:
        action|contains: 'accept'
        service: 'ike'
        vpn_feature: 'ikev1'
    filter_legit:
        src_ip_range:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate remote employee VPN connections
level: high
tags:
    - cve.2026.50751
    - attack.initial_access
    - qilin
---
title: ScreenConnect Path Traversal Exploitation CVE-2024-1708
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects suspicious path traversal patterns in URI queries associated with ConnectWise ScreenConnect authentication bypass (CVE-2024-1708).
status: experimental
date: 2026/06/13
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
    product: connectwise_screenconnect
detection:
    selection_uri:
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '%2fbin%2fsh'
            - 'Web.config'
    selection_status:
        sc-status:
            - 200
            - 500
    condition: all of selection_*
falsepositives:
    - Scanning activity (noise)
level: critical
tags:
    - cve.2024.1708
    - attack.initial_access
    - attack.t1190
    - qilin
---
title: Qilin Ransomware Lateral Movement PsExec
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects the use of PsExec or similar tools for lateral movement, a hallmark of Qilin affiliates moving from the initial beachhead to domain controllers.
status: experimental
date: 2026/06/13
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\psexec.exe'
        - Image|endswith: '\psexec64.exe'
        - OriginalFileName: 'psexec.exe'
    selection_cli:
        CommandLine|contains:
            - '-accepteula'
            - '\\*'
            - '-d '
    condition: 1 of selection_*
falsepositives:
    - Administrative IT tasks
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - qilin

// Hunt for lateral movement and data staging indicators associated with Qilin
// Focuses on PsExec/WMI usage and unusual volume of file modifications
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where InitiatingProcessFileName in ('psexec.exe', 'psexec64.exe', 'wmic.exe', 'powershell.exe')
| where ProcessCommandLine has_any('\\', 'Invoke-Command', 'New-Object', 'DownloadString')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, FolderPath
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(TimeFrame)
    | where ActionType in ('FileCreated', 'FileModified')
    | summarize count() by DeviceName, bin(Timestamp, 5m)
    | where count_ > 50 // Threshold for bulk encryption/staging
) on DeviceName
| project Timestamp, DeviceName, AccountName, CommandLine = ProcessCommandLine, FileActivityCount = count_

<#
.SYNOPSIS
    Qilin Ransomware T-Minus Checklist
.DESCRIPTION
    Rapid response script to hunt for Indicators of Compromise (IOCs) associated with Qilin activity:
    1. Checks for recent suspicious Scheduled Tasks (Persistence).
    2. enumerates Volume Shadow Copy status (often deleted pre-encryption).
    3. Checks for recent PsExec executions.
#>

Write-Host "[+] Starting Qilin IOC Hunt..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 7 days
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($suspiciousTasks) {
    Write-Host "[!] WARNING: Recent Scheduled Tasks found (Potential Persistence):" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author | Format-Table
} else {
    Write-Host "[-] No suspicious recent Scheduled Tasks found." -ForegroundColor Green
}

# 2. Check Volume Shadow Copy Status
try {
    $vss = vssadmin list shadows /for=c: 2>&1
    if ($vss -match "No shadow copies found") {
        Write-Host "[!] CRITICAL: No Volume Shadow Copies found on C:. Deletion likely imminent or completed." -ForegroundColor Red
    } else {
        $shadowCount = ($vss | Select-String "Shadow Copy Volume").Count
        Write-Host "[+] Found $shadowCount shadow copies on C:." -ForegroundColor Green
    }
} catch {
    Write-Host "[!] Error checking VSS." -ForegroundColor Yellow
}

# 3. Check for recent PsExec usage in Event Logs (requires Admin)
$events = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='NewProcessName'] and (Data='psexec.exe' or Data='psexec64.exe')]]" -ErrorAction SilentlyContinue -MaxEvents 10
if ($events) {
    Write-Host "[!] WARNING: PsExec execution detected in Security Logs:" -ForegroundColor Red
    $events | Select-Object TimeCreated, Id, Message | Format-List
} else {
    Write-Host "[-] No recent PsExec events found." -ForegroundColor Green
}

Write-Host "[+] Hunt complete. Review warnings immediately." -ForegroundColor Cyan


---

# Incident Response Priorities

If Qilin activity is suspected, execute the following checklist immediately (T-Minus):

1.  **Isolate the Crown Jewels:** Identify and disconnect file servers containing Legal case files, PII databases, and Financial records. Qilin prioritizes exfiltrating high-value proprietary data.
2.  **Hunt for C2 Beacons:** Look for anomalous PowerShell processes (policies bypassing) and connections to known Cobalt Strike domains or IP addresses.
3.  **Check Perimeter Logs:** Immediate forensic review of VPN (Check Point/Cisco) and Remote Access (ScreenConnect) logs for the period 48 hours prior to the first detection alert. Look for successful logins from impossible travel geolocations.
4.  **Containment:** 
    *   **Priority 1:** Disable the accounts used for lateral movement (usually service accounts).
    *   **Priority 2:** Block inbound VPN traffic from non-corporate IP ranges immediately.

---

# Hardening Recommendations