---
title: Potential ScreenConnect Path Traversal Exploit (CVE-2024-1708)
id: 4e8f2d1a-9b3c-4c5d-8e2f-1a3b4c5d6e7f
description: Detects potential path traversal attempts in ConnectWise ScreenConnect web requests associated with CVE-2024-1708.
status: experimental
date: 2026/08/04
author: Security Arsenal Research
logsource:
    category: webserver
    product: null
detection:
    selection:
        c-uri|contains:
            - '/Services/%60%60%60%60'
            - '/Sessions/%60%60%60%60'
            - '/App_Extensions/'
        cs-method: 'POST'
    condition: selection
level: critical
tags:
    - attack.initial_access
    - cve.2024.1708
    - thegentlemen
    - ransomware
---
title: Suspicious Check Point IKEv1 Key Exchange Anomalies (CVE-2026-50751)
id: 5f9g3e2b-0c4d-5e6f-9a1b-2b3c4d5e6f7g
description: Detects anomalies in Check Point Security Gateway IKEv1 key exchanges indicative of improper authentication exploitation.
status: experimental
date: 2026/08/04
author: Security Arsenal Research
logsource:
    product: firewall
    service: checkpoint
detection:
    selection:
        protocol: 'IKE'
    filter_main_legit_traffic:
        src_ip_range:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    filter_ike_version:
        ike_version|re: '^v1$'
    condition: selection and not filter_main_legit_traffic and filter_ike_version
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
    - thegentlemen
---
title: PowerShell Credential Dumping via Rubeus
id: 6g0h4f3c-1d5e-6f0g-0b2c-3c4d5e6f7g8h
description: Detects execution of Rubeus or similar tools often used by THEGENTLEMEN for credential dumping during lateral movement.
status: experimental
date: 2026/08/04
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'Rubeus'
            - 'Invoke-Kerberoast'
            - 'asktgt'
    condition: selection
level: high
tags:
    - attack.credential_access
    - attack.t1003
    - thegentlemen

let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
| where FileName in~ ("powershell.exe", "cmd.exe", "rar.exe", "7z.exe", "winrar.exe", "vssadmin.exe", "wbadmin.exe")
| where ProcessCommandLine has_any ("delete", "shadow", "copy", "compress", "archive", "export")
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp >= ago(TimeFrame)
    | where ActionType == "ConnectionAllowed"
    | where RemotePort in (443, 80, 21, 22) and InitiatedProcessFileName in~ ("powershell.exe", "cmd.exe")
    | summarize SentBytes=sum(SentBytes), RemoteIP=take_any(RemoteIP) by DeviceId, Timestamp
) on DeviceId, Timestamp
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteIP, SentBytes
| order by Timestamp desc

# THEGENTLEMEN Indicator Hunt - Run as Admin
$Last7Days = (Get-Date).AddDays(-7)

Write-Host "Checking for recent Shadow Copy manipulation..." -ForegroundColor Yellow
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; StartTime=$Last7Days} -ErrorAction SilentlyContinue
if ($VssEvents) { $VssEvents | Select-Object TimeCreated, Message | Format-Table -AutoSize }
else { Write-Host "No VSS events found in last 7 days." }

Write-Host "\nChecking for Scheduled Tasks created in the last 24 hours (Persistence)..." -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddHours(-24)}
if ($RecentTasks) { $RecentTasks | Select-Object TaskName, Date, Author, Actions | Format-List }
else { Write-Host "No recent scheduled tasks found." }

Write-Host "\nChecking for RMM/ScreenConnect Processes..." -ForegroundColor Yellow
$Processes = Get-Process | Where-Object {$_.ProcessName -like "*ScreenConnect*" -or $_.ProcessName -like "*ConnectWise*"}
if ($Processes) { Write-Host "WARNING: Active RMM processes detected. Verify legitimacy." -ForegroundColor Red }


---

# Incident Response Priorities

**T-Minus Detection Checklist (Pre-Encryption)**
1.  **RMM Anomalies:** Immediate audit of ScreenConnect logs for path traversal signatures (July 31 – Aug 4).
2.  **Firewall Telemetry:** Check Check Point/Cisco FMC logs for failed IKEv1 negotiations followed by successful admin logins.
3.  **LSASS Access:** Hunt for non-system processes accessing `lsass.exe` memory (credential dumping).

**Critical Assets for Exfiltration**
- Customer PII databases (Priority for Financial victims).
- CAD/Engineering schematics (Priority for Manufacturing victims).
- Email stores (.pst/.ost) via Exchange Server exploits.

**Containment Hierarchy**
1.  **Isolate:** Disconnect VPN concentrators and RMM jump servers from the core network immediately.
2.  **Revoke:** Reset credentials for all service accounts used by Check Point and ScreenConnect.
3.  **Block:** Block outbound traffic to known file-sharing domains (Mega, MediaFire) and non-corporate IP ranges.

---

# Hardening Recommendations

**Immediate (24h)**
- **Patch:** Apply patches for **CVE-2024-1708** (ScreenConnect) and **CVE-2026-50751** (Check Point) immediately.
- **MFA Enforcement:** Enforce FIDO2/WebAuthn MFA for all VPN and RMM access; disable legacy MFA methods if possible.
- **RMM Hygiene:** Change local admin passwords on all systems managed by RMM tools.

**Short-term (2 Weeks)**
- **Network Segmentation:** Restrict management plane access (ScreenConnect, SSH, RDP) to dedicated jump hosts with strict allow-listing.
- **E-DR Expansion:** Deploy EDR agents to all edge devices and management servers (often overlooked).
- **Audit Exchange:** Apply the security update for **CVE-2023-21529** and conduct a audit for suspicious PowerShell web shells (`.aspx`, `.ps1`).