SILENTRANSOMGROUP Ransomware Campaign: 4 Victims Posted in 48 Hours — BigLaw Targeting Analysis, Detection Rules & Hunting Queries

---
title: Check Point VPN Exploitation Followed by Suspicious Internal Authentication (CVE-2026-50751)
id: 7a3f1c2e-9b4d-4e8a-a1c5-srg0001
status: experimental
description: Detects anomalous IKEv1/VPN authentication events followed within a short window by first-seen internal logons from the VPN gateway subnet — consistent with SILENTRANSOMGROUP perimeter exploitation of Check Point Security Gateway improper authentication.
author: Security Arsenal Threat Intel
logsource:
  category: authentication
  product: checkpoint
detection:
  selection_vpn_anomaly:
    - ike_mode: 'v1'
      auth_result: 'success'
    - failure_count|gte: 10
  filter_known_users:
    user|startswith:
      - 'svc-'
      - 'vpn-svc'
  condition: selection_vpn_anomaly and not filter_known_users
falsepositives:
  - Legacy IKEv1 clients; scheduled VPN health checks
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - cve.2026.50751
date: 2026/09/03
---
title: RMM Tool Abuse — ScreenConnect or Unauthorized Remote Access Execution
description: Identifies execution of ConnectWise ScreenConnect components or newly installed remote access tooling outside approved software paths, a hallmark of SILENTRANSOMGROUP affiliate lateral movement and persistence (CVE-2024-1708 abuse).
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.Service.exe'
      - '\AnyDesk.exe'
      - '\AteraAgent.exe'
      - '\TeamViewer_Service.exe'
  selection_suspicious_path:
    Image|startswith:
      - 'C:\ProgramData\'
      - 'C:\Users\Public\'
      - 'C:\Windows\Temp\'
      - 'C:\PerfLogs\'
  condition: selection_rmm and selection_suspicious_path
falsepositives:
  - IT-managed RMM deployments in nonstandard paths
level: high
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.t1105
date: 2026/09/03
---
title: Pre-Ransomware Staging — Shadow Copy Deletion and Backup Tampering via Legitimate Admin Tools
id: 7a3f1c2e-9b4d-4e8a-a1c5-srg0003
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and recovery disabling — the final T-minus action before SILENTRANSOMGROUP detonates encryption.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete catalog'
  condition: 1 of selection_*
falsepositives:
  - Legitimate storage reclamation by backup administrators (rare on endpoints)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
date: 2026/09/03

// SILENTRANSOMGROUP pre-ransomware staging hunt: mass file access bursts,
// admin-tool lateral movement, and exfil staging on file shares — 72h window
let lookback = 72h;
let AdminTools = dynamic(["psexec.exe","psexesvc.exe","wmic.exe","wmiprvse.exe","winrs.exe","rclone.exe","megasync.exe","7z.exe","rar.exe"]);
// Stage 1: hosts executing staging/archiving or exfil tooling
let StagingHosts = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName has_any (AdminTools)
| summarize FirstSeen=min(Timestamp), CmdLines=make_set(ProcessCommandLine, 10) by DeviceName, InitiatingProcessAccountName;
// Stage 2: same hosts showing remote logon from unusual sources
let Lateral = DeviceLogonEvents
| where Timestamp > ago(lookback)
| where LogonType in ("RemoteInteractive","Network")
| where DeviceName in (StagingHosts | project DeviceName)
| summarize RemoteLogons=count, Sources=make_set(RemoteIP, 10) by DeviceName, AccountName;
// Stage 3: bulk file reads consistent with pre-exfil collection
let BulkAccess = DeviceFileEvents
| where Timestamp > ago(lookback)
| where DeviceName in (StagingHosts | project DeviceName)
| where ActionType == "FileCreated" and FolderPath has_any ("\\Temp\\","\\ProgramData\\","staging","backup")
| summarize StagedFiles=count, ExtList=make_set(tostring(split(FileName,".")[-1]), 15) by DeviceName;
StagingHosts
| join kind=inner Lateral on DeviceName
| join kind=inner BulkAccess on DeviceName
| project DeviceName, InitiatingProcessAccountName, FirstSeen, CmdLines, RemoteLogons, Sources, StagedFiles, ExtList
| order by StagedFiles desc;

# Security Arsenal — SILENTRANSOMGROUP rapid T-minus sweep
# Run elevated on suspected hosts. Checks: shadow copy tampering, new scheduled
# tasks (7d), unauthorized RMM services, exposed RDP, suspicious recent logons.
$cutoff = (Get-Date).AddDays(-7)
$findings = @()

# 1. Volume Shadow Copy status
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { $findings += '[CRITICAL] No Volume Shadow Copies present — possible vssadmin deletion (pre-encryption indicator).' }

# 2. Scheduled tasks created in last 7 days
Get-ScheduledTask | ForEach-Object {
  $info = Get-ScheduledTaskInfo $_ -ErrorAction SilentlyContinue
  $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction SilentlyContinue
  if ($xml -match 'RegistrationInfo') {
    if (([xml]$xml).Task.RegistrationInfo.Date -as [datetime] -gt $cutoff) {
      $findings += "[HIGH] New scheduled task: $($_.TaskPath)$($_.TaskName)"
    }
  }
}

# 3. Unauthorized RMM services
$rmm = 'ScreenConnect','AnyDesk','Atera','TeamViewer','Splashtop','LogMeIn'
Get-Service | Where-Object { $n=$_.Name; $rmm | Where-Object { $n -like "*$_*" } } | ForEach-Object {
  $findings += "[HIGH] RMM service present: $($_.Name) — verify against approved software inventory (CVE-2024-1708 abuse vector)."
}

# 4. RDP exposure
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) { $findings += '[MED] RDP listening on 3389 — confirm it is not internet-exposed and NLA is enforced.' }

# 5. Failed logon burst (brute force indicator)
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -ErrorAction SilentlyContinue
if (($fails | Measure-Object).Count -gt 500) { $findings += "[HIGH] $($fails.Count) failed logons in 7 days — possible RDP/VPN brute force or password spray." }

$findings | ForEach-Object { Write-Output $_ }
if (-not $findings) { Write-Output '[OK] No T-minus indicators detected on this host.' }