---
title: Potential ConnectWise ScreenConnect Authentication Bypass or Path Traversal
id: 4c1f4b24-8a1c-4a92-9b1a-0f9b2c3d4e5f
description: Detects suspicious path traversal or authentication bypass attempts on ConnectWise ScreenConnect web interface indicative of CVE-2024-1708 exploitation.
status: experimental
date: 2026/05/17
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '/Bin/ScreenConnect.'
            - '..\\'
            - '%2e%2e'
        sc-status:
            - 200
            - 500
    condition: selection
falsepositives:
    - Legitimate administrative misconfiguration
level: high
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware.qilin

---
title: SmarterMail Suspicious File Upload Activity
id: 5d2e5c35-9b2d-5b03-0c2b-1g0c3d4e5f6g
description: Detects potential web shell upload via SmarterMail vulnerabilities (CVE-2025-52691). Monitor for unusual file extensions in web directories.
status: experimental
date: 2026/05/17
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: file_creation
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - 'C\\Program Files (x86)\\SmarterTools\\SmarterMail\\MRS'
            - 'C\\inetpub\\mailroot'
        TargetFilename|endswith:
            - '.aspx'
            - '.ashx'
            - '.asmx'
    filter:
        Image|contains:
            - 'SmarterMail'
            - 'MailService'
    condition: selection and not filter
falsepositives:
    - Legitimate system administration
level: critical
tags:
    - attack.initial_access
    - cve.2025.52691
    - attack.web_shell

---
title: Suspicious Cobalt Strike Beacon Activity (Qilin Common)
id: 6e3f6d46-0c3e-6c14-1d3c-2h1d4e5f6g7h
description: Detects process injection patterns often associated with Cobalt Strike beacons used by Qilin affiliates for lateral movement.
status: experimental
date: 2026/05/17
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\\svchost.exe'
            - '\\explorer.exe'
            - '\\wmiprvse.exe'
        Image|endswith:
            - '\\rundll32.exe'
            - '\\regsvr32.exe'
        CommandLine|contains:
            - 'javascript:'
            - 'ZwAllocateVirtualMemory'
    condition: selection
falsepositives:
    - Legitimate software installers
level: high
tags:
    - attack.lateral_movement
    - attack.t1055
    - ransomware.qilin

let TimeFrame = ago(7d);
let CommonLateralTools = dynamic(["psexec", "psexec64", "wmic", "wmi", "powershell", "cmd"]);
DeviceProcessEvents
| where Timestamp >= TimeFrame
| where FileName in~ CommonLateralTools
| where ProcessCommandLine has "\\\\" and (ProcessCommandLine has "-c" or ProcessCommandLine has "call" or ProcessCommandLine has "create")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| join kind=inner ( 
    DeviceNetworkEvents
    | where Timestamp >= TimeFrame
    | where RemotePort in (445, 135) and ActionType == "ConnectionSuccess" 
    | summarize ConnectionCount=count() by DeviceName, RemoteUrl, RemoteIP, Timestamp 
    | where ConnectionCount > 10 
) on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemoteUrl, ConnectionCount
| order by Timestamp desc

<#
.SYNOPSIS
    Qilin Ransomware Persistence Check
.DESCRIPTION
    Enumerates scheduled tasks created in the last 7 days and services with unusual binary paths.
#>

$DateCutoff = (Get-Date).AddDays(-7)
Write-Host "[+] Checking for Scheduled Tasks created/modified in the last 7 days..." -ForegroundColor Cyan

Get-ScheduledTask | Where-Object {
    $_.Date -ge $DateCutoff -or $_.LastRunTime -ge $DateCutoff
} | ForEach-Object {
    $Action = $_.Actions.Execute
    if ($Action -match "powershell" -or $Action -match "cmd" -or $Action -match "rundll32") {
        Write-Host "WARNING: Suspicious Task Found: $($_.TaskName)" -ForegroundColor Red
        Write-Host "  Action: $Action" -ForegroundColor Yellow
        Write-Host "  Author: $($_.Author)" -ForegroundColor Yellow
    }
}

Write-Host "[+] Checking for Services with Unusual Paths..." -ForegroundColor Cyan

Get-WmiObject Win32_Service | Where-Object {
    $_.PathName -notmatch "C:\\Windows\\System32\\" -and 
    $_.PathName -notmatch "C:\\Program Files" -and 
    $_.State -eq "Running"
} | Select-Object Name, DisplayName, PathName, State | Format-Table -AutoSize


---

# Incident Response Priorities

**T-minus Detection Checklist (Pre-Encryption):**
1.  **ScreenConnect Logs:** Immediate audit of `Web Server` logs for the last 14 days looking for path traversal (`../`) or异常的 500 errors.
2.  **SmarterMail/Exchange Servers:** Hunt for web shells in `C:\inetpub\mailroot` or `C:\Program Files\SmarterTools`. Look for recently created `.aspx` files.
3.  **PowerShell AMSI:** Check for AMSI events related to Base64 encoded strings or `System.Management.Automation` invocations.

**Critical Assets Prioritized for Exfiltration:**
- **Healthcare:** Patient PII/PHI, insurance databases, donor lists.
- **Manufacturing:** CAD drawings, intellectual property, ERP systems (SAP/Oracle), supply chain vendor lists.

**Containment Actions (Order by Urgency):**
1.  **Isolate Internet-Facing Appliances:** Disconnect all ScreenConnect, VPN, and Mail servers from the network immediately.
2.  **Disable SMB/WinRM:** If internal propagation is suspected, disable SMBv1 and block WinRM traffic at the firewall level.
3.  **Revoke Credentials:** Force reset of privileged admin credentials (Domain Admins) if potential exposure is confirmed.

---

# Hardening Recommendations

**Immediate (24h):**
- **Patch CVE-2024-1708 (ConnectWise):** Upgrade ScreenConnect to the latest patched version immediately.
- **Patch CVE-2025-52691 & CVE-2026-23760 (SmarterMail):** Apply the vendor patches for the file upload and auth bypass vulnerabilities.
- **Patch CVE-2023-21529 (Exchange):** Ensure the latest Security Update for Exchange Server is installed.
- **MFA Enforcement:** Enforce phishing-resistant MFA on all VPN and remote access portals.

**Short-term (2 weeks):**
- **Network Segmentation:** Ensure management interfaces (like ScreenConnect) are on a dedicated VLAN, accessible only via VPN and not directly from the internet.
- **EDR Coverage Audit:** Verify that legacy systems and backup servers (often skipped) have active EDR agents.

---