title: Potential ConnectWise ScreenConnect Auth Bypass Exploit
description: Detects suspicious process execution patterns associated with CVE-2024-1708 exploitation on ScreenConnect servers.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/26
status: experimental
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\ScreenConnect.ClientService.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate administrator troubleshooting via ScreenConnect
level: critical
---
title: SmarterMail Suspicious File Upload Activity
description: Detects potential exploitation of SmarterMail via web logs indicating file upload extensions often used in webshells.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/26
status: experimental
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.52691
logsource:
    product: webserver
detection:
    selection_uri:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'Services/MailService.asmx'
            - 'Services/Service.asmx'
    selection_ext:
        cs-uri-query|contains:
            - '.aspx'
            - '.ashx'
    condition: all of selection_*
falsepositives:
    - Legitimate email client attachments
level: high
---
title: Ransomware Data Staging via Robocopy
description: Detects the use of robocopy for mass data copying, a common precursor to exfiltration by groups like Qilin.
references:
    - Internal Ransomware Investigations
author: Security Arsenal Research
date: 2026/05/26
status: experimental
tags:
    - attack.collection
    - attack.t1005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\robocopy.exe'
        CommandLine|contains:
            - '/COPYALL'
            - '/E'
            - '/ZB'
    condition: selection
falsepositives:
    - Legitimate system backup tasks
level: medium

// Hunt for suspicious lateral movement and remote execution indicative of Qilin post-exploitation
DeviceProcessEvents 
| where Timestamp > ago(7d) 
| where FileName in~ ("wmic.exe", "powershell.exe", "cmd.exe") 
| where ProcessCommandLine has_any ("node", "js", "VBScript", "Encode", "DownloadString") 
 or ProcessCommandLine matches regex @"\s\/node\s"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

<#
.SYNOPSIS
    Checks for common Qilin pre-encryption artifacts.
.DESCRIPTION
    This script checks for recent deletion of Volume Shadow Copies (VSS) and 
    enumerates scheduled tasks created in the last 24 hours.
#>

Write-Host "[!] Checking for VSS Deletion Events..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='VSS'; ID=12343} -ErrorAction SilentlyContinue -MaxEvents 10
if ($vssEvents) {
    Write-Host "[ALERT] Recent Volume Shadow Copy Deletion Detected:" -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[OK] No recent VSS deletion events found." -ForegroundColor Green
}

Write-Host "\n[!] Enumerating Scheduled Tasks created in last 24 hours..." -ForegroundColor Yellow
$tasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddHours(-24) }
if ($tasks) {
    Write-Host "[ALERT] Recently Created Scheduled Tasks (Potential Persistence):" -ForegroundColor Red
    $tasks | Select-Object TaskName, Date, Author 
} else {
    Write-Host "[OK] No new scheduled tasks found." -ForegroundColor Green
}

Write-Host "\n[!] Checking for suspicious RDP logons (Type 10) via generic accounts..." -ForegroundColor Yellow
$rdp = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; Data=10} -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-24) }
if ($rdp) {
    Write-Host "[INFO] Recent RDP Logons found. Manual review recommended." -ForegroundColor Cyan
}


---

# Incident Response Priorities

1.  **T-minus Detection Checklist:**
    *   **ScreenConnect Logs:** immediate review of `ScreenConnect.Service` logs for `PathTraversal` or `AuthenticationError` spikes on `2026-05-20` through `2026-05-24`.
    *   **Web Server Logs:** Scan SmarterMail/IIS logs for `POST` requests to `Services/MailService.asmx` containing suspicious extensions or large payloads.
    *   **PowerShell:** Hunt for base64 encoded strings in `powershell.exe` process arguments.

2.  **Critical Assets (Targeted for Exfiltration):**
    *   Client databases (CRM/ERP).
    *   Executive email archives (PST/OST files).
    *   Financial records (Audit reports, Tax documents).
    *   Source code repositories (observed in `Semgrep` victim).

3.  **Containment Actions (Order by Urgency):**
    *   **Immediate:** Isolate systems running vulnerable versions of ConnectWise ScreenConnect and SmarterMail. Block inbound internet traffic to these management interfaces at the perimeter firewall.
    *   **High:** Reset credentials for all service accounts (especially those with domain admin privileges) used on the affected email servers or remote access tools.
    *   **Medium:** Suspend all non-essential scheduled tasks and audit WMI repository for suspicious event consumers.

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch Management:** Apply patches for CVE-2024-1708 (ScreenConnect), CVE-2025-52691, and CVE-2026-23760 (SmarterMail) immediately. If patching is not possible, disable the services or place them behind a zero-trust VPN with strict MFA.
*   **Access Control:** Enforce strict MFA on all remote access gateways. Ensure the MFA challenge cannot be bypassed (e.g., no trusted IP ranges that bypass MFA).

**Short-Term (2 Weeks):**
*   **Network Segmentation:** Implement stricter segmentation between IT management tools (ScreenConnect/SmarterMail) and the rest of the internal network. These tools should not be able to initiate RDP/WinRM to domain controllers without explicit firewall rules.
*   **EDR Tuning:** Configure EDR policies to flag the execution of `powershell.exe` spawned by web server processes or management utilities as "Suspicious" rather than "Informative".

---