title: Potential ScreenConnect Path Traversal Exploitation (CVE-2024-1708)
id: 9a1c3d45-6b78-4c12-a89e-1f23a45b6c7d
description: Detects potential exploitation of CVE-2024-1708 in ConnectWise ScreenConnect via suspicious URL patterns in web logs.
status: experimental
date: 2026/05/14
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - 'SessionManager.ashx'
            - '../../..'
            - '%2e%2e%2f'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: SmarterMail Suspicious File Upload Activity (CVE-2025-52691)
id: b2c4e678-9d01-4f5b-8a12-3c45d6e789f0
description: Detects potential exploit attempts targeting SmarterMail unrestricted file upload vulnerability.
status: experimental
date: 2026/05/14
author: Security Arsenal
logsource:
    product: smtp
    service: smtp
detection:
    selection:
        ImagePath|contains: 'SmartMail'
        TargetFilename|contains: '.aspx'
    condition: selection
falsepositives:
    - Legitimate administration
level: high
---
title: Suspicious PowerShell Encoded Command Execution
description: Detects Base64 encoded PowerShell command lines often used by Qilin for staging and exfil.
status: experimental
date: 2026/05/14
author: Security Arsenal
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains: ' -e '
    filter_legit:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
    condition: selection and not filter_legit
falsepositives:
    - Administrative scripts
level: high

// Hunt for lateral movement and staging indicators associated with Qilin
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Look for Qilin common tools: PsExec, WMI, Rclone
| where ProcessName in~ ('psexec.exe', 'psexec64.exe', 'wmic.exe', 'rclone.exe')
| extend AccountCustomEntity = AccountName, HostCustomEntity = DeviceName, ProcessCustomEntity = ProcessName
| project Timestamp, DeviceName, AccountName, ProcessName, InitiatingProcessFileName, CommandLine
| order by Timestamp desc

# Qilin Response Hardening: Identify Scheduled Tasks for Persistence and Check Volume Shadow Copies
Write-Host "Checking for suspicious scheduled tasks created in the last 7 days..." -ForegroundColor Yellow

$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }

if ($suspiciousTasks) {
    Write-Host "[ALERT] Found recently created scheduled tasks:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author | Format-Table
} else {
    Write-Host "[INFO] No recent suspicious scheduled tasks found." -ForegroundColor Green
}

Write-Host "Checking Volume Shadow Copy status..." -ForegroundColor Cyan
try {
    $vss = vssadmin list shadows
    if ($vss -like "No shadow copies found") {
        Write-Host "[WARNING] No Shadow Copies exist. Recovery options may be limited." -ForegroundColor Red
    } else {
        Write-Host "[INFO] Shadow Copies are present." -ForegroundColor Green
    }
} catch {
    Write-Host "[ERROR] Could not query VSS." -ForegroundColor Red
}


---

# Incident Response Priorities

**T-Minus Detection Checklist:**
1.  **Web Server Logs:** Immediately scan IIS/Apache logs for indicators of **CVE-2024-1708** (ConnectWise) or **CVE-2026-20131** (Cisco FMC).
2.  **MFA Bypass:** Review VPN and Remote Access logs for successful logins immediately followed by bulk file access.
3.  **PowerShell Auditing:** Search for encoded commands ( `-enc ` or `-e `) executed by `SYSTEM` or `IIS AppPool` accounts.

**Critical Assets for Exfil:**
Qilin historically prioritizes:
*   **PII/PHI:** From healthcare and legal services (e.g., One Legal).
*   **IP/Proprietary Data:** CAD files and schematics from manufacturing targets (e.g., Schulte-Lindhorst).
*   **Financial Data:** Payroll and tax information.

**Containment Actions:**
1.  **Isolate:** Disconnect any suspected ConnectWise ScreenConnect servers from the network immediately.
2.  **Reset Credentials:** Force reset of privileged domain admin accounts and local admin accounts on exposed servers.
3.  **Block IP:** Implement firewall rules blocking inbound traffic from regions outside operational necessity if Geo-IP is not already enforced.

---

# Hardening Recommendations

**Immediate (24h):**
*   **Patch ConnectWise ScreenConnect:** Ensure all instances are updated to the latest build to mitigate **CVE-2024-1708**.
*   **Disable Internet-Facing RDP:** Enforce VPN with MFA for all remote administrative access.
*   **Audit Email Gateways:** Patch SmarterMail (**CVE-2025-52691**) and Exchange servers (**CVE-2023-21529**) if in use.

**Short-term (2 weeks):**
*   **Network Segmentation:** Move critical SCADA and manufacturing control systems (OT) to isolated VLANs, separate from the IT network.
*   **EDR Rollout:** Ensure Endpoint Detection and Response is deployed on all servers, particularly file servers and domain controllers.
*   **Attack Surface Reduction:** Implement ASR rules in Microsoft Defender to block macro execution from the internet and unauthorized usage of PowerShell.

---