---
title: Potential Check Point Security Gateway IKEv1 Exploitation
id: 8a1b2c3d-4e5f-6789-0123-456789abcdef
description: Detects potential exploitation of CVE-2026-50751 involving improper authentication in IKEv1 key exchanges.
status: experimental
date: 2026/07/20
author: Security Arsenal
logsource:
    product: firewall
    category: network
detection:
    selection:
        destination.port: 500
        protocol: udp
        ckp_product|startswith: 'Check Point'
    filter_legitimate_traffic:
        src_ip:
            - '192.168.0.0/16'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
    condition: selection and not filter_legitimate_traffic
falsepositives:
    - Legitimate remote VPN users (verify via GeoIP)
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
    - safepay
---
title: ScreenConnect Path Traversal Exploitation Attempt
id: 9b2c3d4e-5f6a-7890-1234-567890abcdef
description: Detects exploitation attempts of CVE-2024-1708 in ConnectWise ScreenConnect via path traversal.
status: experimental
date: 2026/07/20
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection_uri:
        cs-uri-query|contains:
            - '..\'
            - '%2e%2e%5c'
    selection_uri_path:
        cs-uri-path|contains: '/Guest.ashx'
    condition: all of selection_*
falsepositives:
    - None expected
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
    - safepay
---
title: Suspicious PsExec Lateral Movement
id: 0c3d4e5f-6a7b-8901-2345-678901bcdef
description: Detects the use of PsExec for lateral movement, common in SAFEPAY ransomware deployments.
status: experimental
date: 2026/07/20
author: Security Arsenal
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName|contains: 'IPC$'
        RelativeTargetName|contains: 'PSEXESVC'
    condition: selection
falsepositives:
    - Administrative IT tasks
level: high
tags:
    - attack.lateral_movement
    - attack.scm_exec
    - safepay

// Hunt for ScreenConnect exploitation and unusual process execution
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
| where ProcessVersionInfoOriginalFileName in ("ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe")
or (ProcessCommandLine contains "powershell" and ProcessCommandLine contains "-enc" and InitiatingProcessFileName in ("ScreenConnect.Service.exe", "sc.exe"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')
| order by Timestamp desc

<#
.SYNOPSIS
    SAFEPAY Rapid Response Check
.DESCRIPTION
    Checks for signs of ScreenConnect exploitation, recent scheduled tasks,
    and unusual RDP connections.
#>

Write-Host "[+] Running SAFEPAY Response Hardening Checks..." -ForegroundColor Cyan

# 1. Check for recently created Scheduled Tasks (Common Persistence)
$suspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-2) -and 
    $_.Author -notmatch "Microsoft|Administrators"
}
if ($suspiciousTasks) {
    Write-Host "[ALERT] Suspicious Scheduled Tasks found created in last 48 hours:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Author, Date | Format-Table
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks." -ForegroundColor Green
}

# 2. Check for ScreenConnect Service running (Unusual if not approved)
$scService = Get-Service -Name "ScreenConnect*" -ErrorAction SilentlyContinue
if ($scService) {
    Write-Host "[WARN] ScreenConnect Service detected. Verify if authorized." -ForegroundColor Yellow
    $scService | Select-Object Name, Status, StartType
}

# 3. Check for recent RDP failures (Brute Force Signs)
$rdpEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | 
Where-Object {$_.Message -like "*Logon Type: 10*"}
if ($rdpEvents) {
    Write-Host "[WARN] High number of RDP failures detected in last 24h." -ForegroundColor Yellow
}

Write-Host "[+] Scan Complete."


---

# Incident Response Priorities

**T-minus Detection Checklist (Pre-Encryption):**
1.  **Check Point Logs:** Immediate review of VPN gateway logs for `IKEv1` authentication anomalies or failures from unusual geo-locations (Check CVE-2026-50751 indicators).
2.  **ScreenConnect Audit:** Identify all active sessions on ConnectWise ScreenConnect instances. Terminate any sessions initiated by accounts not directly tied to open support tickets.
3.  **Volume Shadow Copies:** Monitor for `vssadmin.exe` delete shadows commands using EDR telemetry.

**Critical Assets for Exfiltration:**
Historically, SAFEPAY prioritizes:
- CAD/CAM designs and proprietary manufacturing schematics (.dwg, .stp).
- Client financial data and tax records (Business Services sector).
- ERP databases (SAP, Oracle) for extortion leverage.

**Containment Actions:**
1.  **Isolate:** Disconnect management interfaces (Cisco FMC, Check Point) from the internet if patching cannot be verified immediately.
2.  **Revoke Credentials:** Force-reset credentials for all local admin accounts and service accounts used by the SOC/IT team (assume Active Directory compromise).
3.  **Block Outbound:** Restrict egress traffic to known IP ranges only; block RDP (3389) and SMB (445) outbound at the firewall.

---

# Hardening Recommendations

**Immediate (24 Hours):**
- **Patch CVE-2026-50751:** Apply the latest Check Point Security Gateway hotfixes immediately. Disable IKEv1 if not strictly required for legacy compatibility.
- **Patch CVE-2024-1708:** Ensure ConnectWise ScreenConnect instances are updated to the latest patched version (23.9.8+).
- **MFA Enforcement:** Enforce Multi-Factor Authentication (MFA) on all VPN entry points and remote access tools.

**Short-term (2 Weeks):**
- **Network Segmentation:** Move critical CAD/ERP servers to an isolated VLAN with strict jump-box access requirements (no direct remote access from the internet).
- **EDR Coverage:** Verify 100% EDR agent coverage on all servers, specifically manufacturing floor endpoints which are often overlooked.
- **Geo-Blocking:** Implement strict Geo-IP blocking on perimeter firewalls, denying access from regions outside of operational business areas.