THEGENTLEMEN Ransomware Gang: 21 Victims Posted — Healthcare & Logistics Targeting & Detection Rules

---
title: Potential THEGENTLEMEN Initial Access via ScreenConnect Exploit
id: 48a2e111-6d3f-4c8f-b9f1-3d0f1c8e3d1a
description: Detects exploitation of ConnectWise ScreenConnect (CVE-2024-1708) often used by THEGENTLEMEN for initial access. Looks for suspicious path traversal patterns in URI.
status: experimental
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/06/04
modified: 2026/06/04
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
logsource:
    category: web
detection:
    selection:
        cs-uri-query|contains:
            - '..\\'
            - '..%5c'
            - '%2e%2e%5c'
        cs-uri-stem|contains: '/Setup/'
    condition: selection
falsepositives:
    - Unknown
level: critical

---
title: THEGENTLEMEN Lateral Movement via PsExec
id: 99b8c4d2-1a3e-4f5b-9e6d-7c8f9a0b1c2d
description: Detects lateral movement patterns indicative of THEGENTLEMEN affiliates using PsExec to spread across the network pre-encryption.
status: experimental
author: Security Arsenal
date: 2026/06/04
tags:
    - attack.lateral_movement
    - attack.t1021.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\\PsExec.exe'
        OriginalFileName: 'psexec.exe'
    selection_cli:
        CommandLine|contains:
            - '\\192.168.'
            - '\\10.'
            - '/accepteula'
    condition: all of selection_*
falsepositives:
    - Administrative IT tasks
level: high

---
title: THEGENTLEMEN Data Staging Large File Copy
id: a1b2c3d4-5e6f-7890-abcd-ef1234567890
description: Detects rapid mass file copying consistent with ransomware data staging prior to exfiltration. High volume of file creation on a single drive.
status: experimental
author: Security Arsenal
date: 2026/06/04
tags:
    - attack.collection
    - attack.t1074.001
logsource:
    category: file_create
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - ':\\Staging\'
            - ':\\Temp\Ransom'
    filter_legit:
        Image|contains:
            - '\\Program Files\'
            - '\\Windows\\System32\'
    timeframe: 1h
    condition: selection and not filter_legit | count(TargetFilename) > 50
falsepositives:
    - Backup software operations
level: medium

// Hunt for THEGENTLEMEN lateral movement indicators
// Looks for SMB access to multiple hosts and remote service installation
let TimeFrame = 1h;
DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where RemotePort == 445 // SMB
| summarize count() by DeviceName, RemoteIP
| where count_ > 10 // Threshold for lateral movement scanning
| join kind=inner (DeviceProcessEvents 
    | where Timestamp > ago(TimeFrame) 
    | where ProcessCommandLine contains "sc.exe" and ProcessCommandLine contains "create" // Service creation often used for persistence
) on $left.DeviceName == $right.DeviceName
| project Timestamp, DeviceName, RemoteIP, ProcessCommandLine, InitiatingProcessFileName

# THEGENTLEMEN Rapid Response Check
# Checks for suspicious scheduled tasks (persistence) and modified VSS (ransomware prep)

Write-Host "[+] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Cyan
$DateCutoff = (Get-Date).AddDays(-7)
$SuspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt $DateCutoff }

if ($SuspiciousTasks) {
    Write-Host "[!] ALERT: Found recently created scheduled tasks:" -ForegroundColor Red
    $SuspiciousTasks | Format-List TaskName, TaskPath, Date, Author
} else {
    Write-Host "[-] No suspicious tasks found." -ForegroundColor Green
}

Write-Host "\n[+] Checking Volume Shadow Copy Service (VSS) state..." -ForegroundColor Cyan
try {
    $VSS = vssadmin list shadows
    if ($VSS -match "No shadow copies") {
        Write-Host "[!] WARNING: No shadow copies found. Possible deletion." -ForegroundColor Yellow
    } else {
        Write-Host "[-] Shadow copies exist." -ForegroundColor Green
        # Check recent modifications to VSS writers
        $WriterStatus = vssadmin list writers
        if ($WriterStatus -match "State: \[5\]" -or $WriterStatus -match "State: \[6\]") {
             Write-Host "[!] WARNING: VSS Writers in failed state." -ForegroundColor Yellow
        }
    }
} catch {
    Write-Host "[!] Error checking VSS: $_" -ForegroundColor Red
}

Write-Host "\n[+] Check complete." -ForegroundColor Cyan


---