---
id: 7b1f9a2d-4c8e-11ef-9454-0242ac120004
title: Potential ScreenConnect Auth Bypass Exploit (CVE-2024-1708)
description: Detects potential exploitation of the ConnectWise ScreenConnect authentication bypass vulnerability via suspicious URL patterns or web shell activity.
status: experimental
author: Security Arsenal Research
date: 2026/06/05
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
detection:
    selection:
        cs-uri-query|contains:
            - '/App_Extensions/'
            - '/WebService.asmx/'
            - 'SetupWizard'
        cs-method: POST
    filter:
        cs-user-agent|contains:
            - 'ScreenConnect'
            - 'ConnectWise'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative access via ScreenConnect
level: critical

tags:
    - cve.2024.1708
    - attack.initial_access
    - thegentlemen
    - ransomware
---
id: 8c2g0b3e-5d9f-22fg-0565-0353bd231115
title: Suspicious Exchange Server PowerShell Deserialization (CVE-2023-21529)
description: Detects signs of deserialization attacks against Microsoft Exchange Server leading to remote code execution.
status: experimental
author: Security Arsenal Research
date: 2026/06/05
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'System.Management.Automation'
            - 'Serialization'
    filter_legit:
        ParentProcessName|contains:
            - '\Exchange Server\'
            - '\Management\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate Exchange Management Shell usage
level: high

tags:
    - cve.2023.21529
    - attack.initial_access
    - thegentlemen
    - ransomware
---
id: 9d3h1c4f-6e0g-33gh-1676-1464ce342226
title: Mass Volume Shadow Copy Deletion - Ransomware Precursor
description: Detects attempts to delete Volume Shadow Copies via vssadmin or diskshadow, a common precursor to ransomware encryption used by THEGENTLEMEN.
status: experimental
author: Security Arsenal Research
date: 2026/06/05
logsource:
    category: process_creation
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_diskshadow:
        Image|endswith: '\diskshadow.exe'
        CommandLine|contains: 'delete shadows'
    condition: 1 of selection*
falsepositives:
    - Legitimate system administration (rare)
level: critical

tags:
    - attack.impact
    - thegentlemen
    - ransomware

let StartTime = ago(7d);
DeviceProcessEvents
| where Timestamp >= StartTime
| where (FileName in~ ('psexec.exe', 'psexec64.exe', 'wmic.exe') or
        ProcessCommandLine has_any('Invoke-WmiMethod', 'New-CimInstance'))
| where InitiatingProcessFileName !in~ ('services.exe', 'svchost.exe', 'mmc.exe')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
| order by Timestamp desc

# THEGENTLEMEN Ransomware - Rapid Triage Script
# Run as Administrator

Write-Host "[+] Checking for recent suspicious Scheduled Tasks (Last 24h)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddHours(-24)} | 
    Select-Object TaskName, TaskPath, Date, Author, Actions | Format-Table -AutoSize

Write-Host "\n[+] Checking Volume Shadow Copy Storage health and recent deletions..." -ForegroundColor Cyan
Try {
    $vss = vssadmin list shadows
    if ($vss -match "No shadow copies found") {
        Write-Host "[!] WARNING: No Shadow Copies exist. Potential deletion or system misconfiguration." -ForegroundColor Red
    } else {
        Write-Host "[+] Shadow Copies detected. Reviewing creation times..." -ForegroundColor Green
        $vss
    }
} Catch {
    Write-Host "[!] Error checking VSS: $_" -ForegroundColor Yellow
}

Write-Host "\n[+] Enumerating established non-local RDP connections (ScreenConnect/SMB)..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established | 
    Where-Object {$_.LocalPort -eq 3389 -or $_.LocalPort -eq 445} | 
    Where-Object {$_.RemoteAddress -notlike '127.*' -and $_.RemoteAddress -notlike '10.*' -and $_.RemoteAddress -notlike '192.168.*' -and $_.RemoteAddress -notlike '172.16.*'} | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, State, OwningProcess | Format-Table -AutoSize

Write-Host "\n[+] Triage Complete. Review output for anomalies." -ForegroundColor Green


---

# Incident Response Priorities

Based on the observed TTPs of THEGENTLEMEN, prioritize the following actions if a breach is suspected:

1.  **T-Minus Detection Checklist (Pre-Encryption):**
    *   **Isolate VPN/RD Gateway:** Immediately disconnect internet-facing RDP and ScreenConnect appliances.
    *   **Audit Exchange Logs:** Look for `Cmdlet-Agent` logins or unexpected IIS worker process activity (`w3wp.exe`) spawning PowerShell.
    *   **Network Traffic:** Hunt for large outbound data transfers (Exfiltration) to non-corporate IPs occurring between 2300 and 0500.

2.  **Critical Assets to Protect:**
    *   **EHR/EMR Databases:** The primary target for the Healthcare victims. Confirm access logs for SQL servers.
    *   **File Shares:** `\Users\`, `\HR\`, and `\Finance\` shares are typically staged first.
    *   **Backup Repositories:** Verify Veeam/Azure Backup credentials have not been rotated or compromised.

3.  **Containment Actions (Ordered by Urgency):**
    *   **Disconnect:** Pull the plug on identified victims (physical isolation if necessary).
    *   **Reset Service Accounts:** Force password resets for accounts used by ConnectWise ScreenConnect and Exchange Sync services.
    *   **Block C2:** Implement firewall blocks for known C2 infrastructure associated with recent NX Console or ScreenConnect exploits.

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch CVE-2024-1708 (ScreenConnect):** Upgrade ConnectWise ScreenConnect to the latest patched version immediately. If patching is impossible, enforce MFA on all ScreenConnect logins and block external access at the firewall until patched.
*   **Patch CVE-2023-21529 (Exchange):** Apply the latest Security Update for Exchange Server.
*   **Audit Remote Access:** Disable any RDP/VPN accounts that are not actively in use. Enforce "Allowed Lists" for remote access IPs.

**Short-Term (2 Weeks):**
*   **Network Segmentation:** Ensure EHR systems and SCADA/Logistics servers are in isolated VLANs with strict egress filtering.
*   **Disable Unauthenticated Services:** Review and disable unnecessary services on Cisco FMC and similar management interfaces exposed to the internet.
*   **Implement Deception:** Deploy honeypot credentials on RDP and ScreenConnect to generate alerts when initial access is attempted.

---