title: Potential ConnectWise ScreenConnect Path Traversal (CVE-2024-1708)
id: 4f0c0d6b-1a2b-3c4d-5e6f-7g8h9i0j1k2l
description: Detects potential exploitation of the ConnectWise ScreenConnect path traversal vulnerability (CVE-2024-1708) which allows remote code execution via malicious URI parameters.
status: experimental
author: Security Arsenal
date: 2026/05/19
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'WebControl.ashx'
            - 'Setup.ashx'
        cs-uri-query|contains:
            - '..%2F'
            - '..%5c'
            - '%2F..%2F'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: critical
---
title: SmarterMail Unrestricted File Upload (CVE-2025-52691)
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects potential exploitation of SmarterMail unrestricted file upload vulnerability leading to RCE via MRS proxy.
status: experimental
author: Security Arsenal
date: 2026/05/19
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
    product: iis
detection:
    selection:
        cs-uri-stem|contains: '/MRS/'
        cs-uri-query|contains: '.aspx?'
    filter:
        cs-method|contains: 'POST'
    condition: selection and filter
falsepositives:
    - Unknown
level: high
---
title: Suspicious Shadow Copy Deletion Activity
description: Detects attempts to delete Volume Shadow Copies which is a common step in QILIN ransomware operations to prevent recovery.
status: experimental
author: Security Arsenal
date: 2026/05/19
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    condition: 1 of selection*
falsepositives:
    - System administrator maintenance
level: high

// Hunt for Qilin precursors: Shadow copy deletion and suspicious PowerShell
DeviceProcessEvents
| where Timestamp > ago(3d)
| where ProcessCommandLine has_any ("vssadmin", "wbadmin", "bcdedit") 
and ProcessCommandLine has_any ("delete", "recoveryenabled no")
| or ProcessCommandLine has "Invoke-ReflectivePEInjection" // Common in Qilin loaders
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

# Qilin Ransomware T-Minus Check: Shadow Copies & Persistence
Write-Host "[+] Checking for QILIN Ransomware Indicators of Compromise..." -ForegroundColor Cyan

# 1. Check for recently deleted Shadow Copies (Event ID 1 from VSS)
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=1; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($vssEvents) {
    Write-Host "[ALERT] Recent Volume Shadow Copy deletion events detected!" -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[INFO] No immediate VSS deletion events found." -ForegroundColor Green
}

# 2. Enumerate Scheduled Tasks created in last 24h (Persistence)
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddHours(-24) }
if ($suspiciousTasks) {
    Write-Host "[ALERT] Suspicious scheduled tasks created in the last 24 hours:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author, Actions
} else {
    Write-Host "[INFO] No new suspicious scheduled tasks." -ForegroundColor Green
}

# 3. Check for common Qilin Ransomware Extensions (if encryption already started)
$drives = Get-PSDrive -PSProvider FileSystem
$foundFiles = @()
foreach ($drive in $drives) {
    $foundFiles += Get-ChildItem -Path $drive.Root -Filter "*.qilin" -Recurse -ErrorAction SilentlyContinue -Depth 2
}
if ($foundFiles) { Write-Host "[CRITICAL] Encrypted files found!" -ForegroundColor Red }


---

# Incident Response Priorities

**T-Minus Detection Checklist:**
*   **Remote Access Logs:** Immediate forensic review of ConnectWise ScreenConnect logs for the specific path traversal patterns (URI containing `..%2F`).
*   **Web Shell Hunt:** Scan web roots (`C:\inetpub\wwwroot`, `C:\Program Files\SmarterTools`) for recently created `.aspx` or `.config` files.
*   **MFA Failures:** Look for spikes in failed MFA attempts on VPN or Remote Desktop protocols, indicating credential stuffing attempts prior to exploitation.

**Critical Assets Targeted for Exfiltration:**
*   **Agriculture:** Supply chain manifests, distributor contracts, and quality assurance data.
*   **Healthcare:** Patient PHI (Protected Health Information), insurance billing records, and research databases.
*   **Manufacturing:** Proprietary CAD designs, client IP, and ERP financial modules.

**Containment Actions (Order by Urgency):**
1.  **Disconnect:** Immediately disconnect internet-facing mail servers (SmarterMail/Exchange) and remote access tools (ScreenConnect) from the network. Do not reboot systems yet to preserve memory artifacts.
2.  **Isolate:** Segment VLANs containing critical production servers and backup repositories.
3.  **Suspend:** Suspend all user accounts with privileged access (Domain Admins) until reset is verified.

---

# Hardening Recommendations

**Immediate (24h):**
*   **Patch CVE-2024-1708:** If ConnectWise ScreenConnect is in use, apply the patch immediately or restrict access to trusted IP ranges via firewall.
*   **Patch CVE-2025-52691:** Update SmarterTools SmarterMail to the latest patched version immediately.
*   **MFA Enforcement:** Ensure that *all* remote access portals, not just VPNs, have enforced MFA (Phishing-resistant FIDO2 preferred).

**Short-term (2 weeks):**
*   **Network Segmentation:** Architect a "DMZ" strictly for external-facing management tools (ScreenConnect, RMM agents) that does not have direct lateral access to the core data network.
*   **Vulnerability Management:** Implement an automated scanning solution specifically for the CISA KEV catalog to alert on new exploitable vulnerabilities targeting your specific software stack.

---