title: Potential ScreenConnect Path Traversal Exploit CVE-2024-1708
id: 8a1b2c3d-4e5f-6789-0abc-def123456789
status: experimental
description: Detects potential exploitation of ConnectWise ScreenConnect path traversal vulnerability via suspicious URI patterns in web logs.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/06/12
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '..%255c'
            - '..\'
            - '%2e%2e'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Check Point VPN Authentication Anomaly Spike
id: b2c3d4e5-6789-0abc-def123456789a
status: experimental
description: Detects a high volume of failed IKEv1 authentication attempts followed by a success, indicative of brute-force or CVE-2026-50751 exploitation.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/06/12
tags:
    - attack.initial_access
    - attack.t1110.003
    - cve.2026.50751
logsource:
    product: firewall
detection:
    selection_high_fail:
        action|contains: 'deny'
        service|contains: 'ike'
        dst_port: 500
    selection_success:
        action|contains: 'accept'
        service|contains: 'ike'
    timeframe: 5m
    condition: selection_high_fail | count() > 50 and selection_success
falsepositives:
    - VPN misconfigurations
    - High user turnover events
level: high
---
title: Suspicious PowerShell Base64 Encoded Command
id: c3d4e5f6-7890-1bcd-ef123456789ab
status: experimental
description: Detects PowerShell processes launched with encoded commands, a common method used by Qilin affiliates for obfuscation and lateral movement.
author: Security Arsenal Research
date: 2026/06/12
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1027
logsource:
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - ' -enc '
            - ' -EncodedCommand '
    filter_legit:
        ParentImage|contains:
            - '\Windows\System32\'
    condition: selection_img and selection_cli and not filter_legit
falsepositives:
    - System management scripts
level: medium

// Hunt for Qilin-associated lateral movement and staging
// Looks for PowerShell spawning network connections (C2 beaconing) and PsExec usage
let ProcessEvents = DeviceProcessEvents 
| where Timestamp > ago(7d);
let NetworkEvents = DeviceNetworkEvents 
| where Timestamp > ago(7d);
ProcessEvents 
| where FileName in~("powershell.exe", "pwsh.exe", "psexec.exe", "psexec64.exe") 
| where ProcessCommandLine contains "-enc" or ProcessCommandLine contains "Invoke-Expression" 
| join kind=inner (
    NetworkEvents 
    | where RemotePort in (443, 8080, 8443) // Common C2 ports
) on DeviceId, InitiatingProcessAccountId 
| summarize count() by DeviceName, FileName, RemoteUrl, InitiatingProcessAccountName 
| project DeviceName, Account=InitiatingProcessAccountName, Process=FileName, C2=RemoteUrl, Count_

<#
.SYNOPSIS
    Qilin Ransomware Pre-Encryption Triage Script
.DESCRIPTION
    Checks for signs of Qilin activity: VSS shadow copy deletion, suspicious scheduled tasks, and recent PowerShell logs.
#>

Write-Host "[+] Checking Volume Shadow Copy Status..." -ForegroundColor Cyan
$vss = vssadmin list shadows
if ($vss -match "No shadow copies found") {
    Write-Host "[!] ALERT: No Volume Shadow Copies found. Possible deletion event." -ForegroundColor Red
} else {
    Write-Host "[OK] Shadow copies exist." -ForegroundColor Green
}

Write-Host "\n[+] Enumerating Scheduled Tasks created/modified in last 7 days..." -ForegroundColor Cyan
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($suspiciousTasks) {
    Write-Host "[!] ALERT: Found recent scheduled tasks:" -ForegroundColor Yellow
    $suspiciousTasks | Select-Object TaskName, Date, Author | Format-Table -AutoSize
} else {
    Write-Host "[OK] No recent suspicious task creation." -ForegroundColor Green
}

Write-Host "\n[+] Checking for recent PowerShell Event Log 4104 (Script Block Logging)..." -ForegroundColor Cyan
$logs = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($logs) {
    $encodedScripts = $logs | Where-Object { $_.Message -match "EncodedCommand" }
    if ($encodedScripts) {
        Write-Host "[!] ALERT: Found encoded PowerShell scripts in the last 24 hours." -ForegroundColor Red
        # Export for analysis
        $encodedScripts | Export-Csv -Path "C:\Temp\Qilin_PowerShell_Triage.csv" -NoTypeInformation
    } else {
        Write-Host "[OK] No encoded script blocks detected recently." -ForegroundColor Green
    }
}


# Incident Response Priorities