title: Suspicious ScreenConnect Authentication Path Traversal
id: 4f3a2b1c-6d8e-4a5b-9f2d-3e4a5b6c7d8e
description: Detects potential exploitation of CVE-2024-1708 or suspicious path traversal in ScreenConnect authentication logs.
status: experimental
date: 2026/07/28
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
definition:
    condition: selection
fields:
    - ClientIP
    - URI
    - UserAgent
falsepositives:
    - Legitimate administrators testing environment
level: high
tags:
    - attack.initial_access
    - cve.2024.1708
    - safepay
selection:
    cs-method: 'POST'
    cs-uri-query|contains:
        - '..%2f'
        - '..\\'
    c-uri|endswith: '/Guest/Authenticate'
---
title: SAFEPAY Lateral Movement via PsExec and WMI
date: 2026/07/28
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects typical lateral movement patterns used by ransomware affiliates including PsExec and WMI process creation.
author: Security Arsenal Research
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\psexec.exe'
            - '\psexec64.exe'
            - '\wmic.exe'
    filter_legit:
        ParentImage|contains:
            - '\Program Files\\'
            - '\System32\\'
    condition: selection and not filter_legit
falsepositives:
    - System administration
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - safepay
---
title: Ransomware Precursor - Volume Shadow Copy Deletion via VssAdmin
date: 2026/07/28
id: e5f6g7h8-9i0j-1k2l-3m4n-5o6p7q8r9s0t
author: Security Arsenal Research
description: Detects attempts to delete Volume Shadow Copies to prevent recovery, a common step in SAFEPAY playbooks.
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    condition: selection
level: critical
tags:
    - attack.impact
    - attack.t1490
    - safepay


kql
// KQL Hunt for SAFEPAY Pre-Encryption Staging
// Hunt for unusual mass file modifications or access to specific admin shares
DeviceProcessEvents  
| where Timestamp >= ago(7d)  
| where FileName in~ ("powershell.exe", "cmd.exe", "robocopy.exe", "rar.exe")  
| where ProcessCommandLine has_any ("-compress", "-a", "/move", "shadow", "vssadmin") 
| where InitiatingProcessFileName !in~ ("explorer.exe", "chrome.exe", "edge.exe") 
| summarize count(), arg_min(Timestamp, *) by DeviceName, AccountName, FileName, ProcessCommandLine 
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName


powershell
# Rapid Response Hardening Script: SAFEPAY Checks
# Checks for suspicious scheduled tasks and exposed administrative shares

Write-Host "[+] Checking for recently created scheduled tasks (Persistence)..."
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, Date, Author, Action

Write-Host "[+] Checking for network connections to non-standard RDP ports..."
Get-NetTCPConnection -State Established | Where-Object {$_.RemotePort -ne 3389 -and $_.RemotePort -gt 0} | 
    Group-Object -Property RemoteAddress | Where-Object {$_.Count -gt 50} | 
    Select-Object Name, Count

Write-Host "[!] Checking Volume Shadow Copy Status..."
$vss = vssadmin list shadows
if ($vss -like "No shadow copies found") {
    Write-Host "[CRITICAL] No Shadow Copies found. Possible deletion event." -ForegroundColor Red
} else {
    Write-Host "[INFO] Shadow Copies exist." -ForegroundColor Green
}


---

# Incident Response Priorities

Based on SAFEPAY's dwell time and velocity, IR teams must act within the first hour of detection.

**T-Minus Detection Checklist:**
1.  **ScreenConnect Audit:** Immediate review of `WebServer.log` for `Guest/Authenticate` anomalies (CVE-2024-1708 indicators).
2.  **Perimeter Firewall Logs:** Hunt for anomalous IKEv1 key exchanges or SSH sessions originating from the listed CVE vectors (Check Point/Cisco).
3.  **Exchange Logs:** Look for `Cmdlet` logs related to `New-MailboxExportRequest` or high-volume mailbox access.

**Critical Assets for Exfiltration:**
*   HR Databases (containing PII/Passport scans)
*   POS Systems (Retail sector - payment track data)
*   Student/Faculty Records (Education sector)

**Containment Actions:**
1.  **Isolate:** Disconnect VPN concentrators and internet-facing Exchange servers immediately if anomalies are detected.
2.  **Revoke Credentials:** Force-reset passwords for all admin accounts that have logged into the network via VPN in the last 14 days.
3.  **Block:** Block inbound traffic from known TOR exit nodes and IPs associated with recent C2 infrastructure.

---

# Hardening Recommendations

**Immediate (24h):**
*   **Patch CVE-2024-1708:** Apply the ConnectWise ScreenConnect patch immediately or enforce MFA on all access instances.
*   **Disable IKEv1:** On Check Point gateways, disable IKEv1 if not strictly required (mitigates CVE-2026-50751).
*   **Disable WMI/WinRM:** Restrict WMI and WinRM traffic to specific management subnets only.

**Short-term (2 weeks):**
*   **Network Segmentation:** Implement strict segmentation between POS networks (Retail) and administrative networks.
*   **EDR Deployment:** Ensure EDR coverage is 100% on all edge devices, not just endpoints.
*   **MFA Enforcement:** Enforce phishing-resistant MFA (FIDO2) for all remote access solutions.