---
title: Potential Check Point IKEv1 Exploitation (CVE-2026-50751)
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential exploitation of Check Point Security Gateway improper authentication vulnerability via IKEv1 anomalies.
status: experimental
date: 2026/06/10
author: Security Arsenal
logsource:
  product: firewall
definition:
  condition: selection
fields:
  - src_ip
  - dst_ip
  - port
falsepositives:
  - Legitimate misconfigured VPN clients
level: high
tags:
  - attack.initial_access
  - cve.2026.50751
  - qilin
detection:
  selection:
    dst_port|startswith: '500'
    protocol|contains: 'IKE'
    action: 'accept'
    error_code|contains:
      'authentication_failed'
      'ikev1_failure'
  filter:
    src_ip:
      - '127.0.0.1'
      - '::1'
---
title: ConnectWise ScreenConnect Path Traversal Exploitation
id: b2c3d4e5-6789-01bc-def2-345678901234
description: Detects suspicious URI patterns associated with CVE-2024-1708 exploitation on ScreenConnect servers.
status: experimental
date: 2026/06/10
author: Security Arsenal
logsource:
  category: web
definition:
  condition: selection
fields:
  - ClientIP
  - UriStem
falsepositives:
  - Legitimate admin access (rare)
level: critical
tags:
  - attack.initial_access
  - cve.2024.1708
  - ransomware
detection:
  selection:
    cs_method: 'GET'
    cs_uri_stem|contains:
      - 'bin/../'
      - 'App_Extensions/../'
      - 'SetupWizard.aspx'
---
title: Suspicious PowerShell Base64 Encoded Command
definition:
  condition: selection
description: Detects Base64 encoded PowerShell commands often used by Qilin for lateral movement.
status: experimental
date: 2026/06/10
author: Security Arsenal
logsource:
  product: windows
  service: security
  definition: 'Requirement: Enable PowerShell Script Block Logging (Event ID 4104)'
falsepositives:
  - Administrative scripts
level: high
tags:
  - attack.execution
  - attack.t1059.001
detection:
  selection:
    EventID: 4104
    Message|contains:
      'FromBase64String'
      'IO.Compression'
  condition: selection

// Hunt for Qilin lateral movement via WMI and PsExec
let TimeFrame = ago(7d);
DeviceProcessEvents
| where Timestamp > TimeFrame
| where InitiatingProcessFileName in~ ("wmiprvse.exe", "powershell.exe", "cmd.exe")
| where ProcessCommandLine has_any ("wmic", "Invoke-WmiMethod", "sc.exe", "psexec")
| where FileName !in~ ("wmiprvse.exe", "conhost.exe")
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, ProcessCommandLine, InitiatingProcessFileName, FileName
| order by Timestamp desc

<#
.SYNOPSIS
    Qilin Ransomware Rapid Response Check
.DESCRIPTION
    Checks for recent shadow copy deletions and suspicious scheduled tasks added in the last 24 hours.
#>

Write-Host "[+] Checking for Shadow Copy Deletions (Last 24h)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; ID=4103; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message | Format-Table -AutoSize

Write-Host "[+] Checking for Scheduled Tasks created in last 24h..." -ForegroundColor Cyan
$Date = (Get-Date).AddDays(-1)
Get-ScheduledTask | Where-Object {$_.Date -gt $Date} | Select-Object TaskName, TaskPath, Author, Date

Write-Host "[+] Checking for typical Qilin process extensions..." -ForegroundColor Cyan
$processes = @("rclone", "winscp", "filezilla", "7z", "rar")
Get-Process | Where-Object {$processes -contains $_.ProcessName} | Select-Object ProcessName, Id, StartTime


---

# Incident Response Priorities

**T-minus Detection Checklist:**
1.  **Check Point Logs:** Review VPN logs for spikes in IKEv1 failures or successful authentications from anomalous geolocations (specifically non-corporate regions) immediately preceding 2026-06-08.
2.  **ScreenConnect Audit:** Audit ScreenConnect/WebConnect logs for path traversal strings (`..%2f`) or logins from unknown ISPs.
3.  **Lateral Movement:** Hunt for `wmiprvse.exe` spawning PowerShell or CMD without legitimate admin context.

**Critical Assets:**
Qilin prioritizes **Patient Health Information (PHI)** in healthcare targets and **Intellectual Property/Blueprints** in manufacturing. They specifically target SQL databases and Backup archives.

**Containment Actions:**
1.  **Immediate:** Disable Internet-accessible VPNs and ScreenConnect instances until CVE-2026-50751 and CVE-2024-1708 patches are verified.
2.  **Segmentation:** Isolate Backup servers from the production network.
3.  **Account Hygiene:** Force reset of credentials for all privileged accounts used on Jump Servers and Firewalls.

---

# Hardening Recommendations

**Immediate (24h):**
*   **Patch:** Apply the emergency patch for **Check Point Security Gateway (CVE-2026-50751)** immediately. This is the current dominant vector.
*   **Disable:** If ScreenConnect (ConnectWise) is not patched for CVE-2024-1708, block external access to the web interface at the firewall level.
*   **MFA Enforcement:** Ensure all VPN and RMM access has FIDO2-compliant MFA; Qilin affiliates are bypassing standard TOTP via session hijacking.

**Short-term (2 weeks):**
*   **Architecture:** Transition to Identity-Aware Proxies (ZTNA) for remote access instead of direct VPN exposure.
*   **Monitoring:** Deploy EDR on all DMZ assets, including Firewall Management Servers (Cisco FMC), as these are now prime targets for initial access.