---
title: Potential Check Point VPN IKEv1 Authentication Bypass
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 key exchange anomalies or unusual VPN login patterns.
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
status: experimental
author: Security Arsenal Research
date: 2026/07/21
tags:
  - attack.initial_access
  - cve.2026.50751
logsource:
  product: checkpoint
  service: vpn
detection:
  selection:
    event_type: 'key_exchange'
    ike_version: 'ikev1'
    action|contains: 'accept'
  filter_legit:
    src_ip|cidr:
      - '192.168.0.0/16'
      - '10.0.0.0/8'
  condition: selection and not filter_legit
falsepositives:
  - Legacy VPN configurations still using IKEv1
level: high
---
title: ScreenConnect Path Traversal Exploitation Attempt
description: Detects directory traversal sequences in ScreenConnect web requests indicative of CVE-2024-1708 exploitation.
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
status: experimental
author: Security Arsenal Research
date: 2026/07/21
tags:
  - attack.initial_access
  - cve.2024.1708
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - '..%2f'
      - '..\\'
  selection_host:
    cs-host|contains: 'ScreenConnect'
  condition: all of selection_*
falsepositives:
  - Scanning activity
level: critical
---
title: Ransomware Data Staging via Archiving Tools
description: Detects mass compression or archiving of files often used by THEGENTLEMEN for exfiltration prior to encryption.
status: experimental
author: Security Arsenal Research
date: 2026/07/21
tags:
  - attack.collection
  - attack.exfiltration
logsource:
  category: process_creation
detection:
  selection_archiver:
    Image|endswith:
      - '\\winrar.exe'
      - '\\7z.exe'
      - '\\winzip.exe'
  selection_args:
    CommandLine|contains:
      - '-a'
      - '-m5'
  selection_volume:
    CommandLine|contains: ":\\"
  filter_legit:
    ParentImage|contains:
      - '\\Program Files\\\\'
  condition: selection_archiver and selection_args and selection_volume and not filter_legit
falsepositives:
  - Admin backups
level: high


kql
// KQL Hunt for Lateral Movement & Staging associated with THEGENTLEMEN
// Hunt for suspicious SMB/WMI executions and unusual file modifications
let TimeRange = ago(7d);
DeviceProcessEvents
| where Timestamp > TimeRange
| where ProcessName has "psexec.exe" or ProcessName has "wmic.exe"
| extend CommandLine = tostring(ProcessCommandLine)
| where CommandLine contains ":\\" or CommandLine contains "\\\\"
| project Timestamp, DeviceName, AccountName, ProcessName, CommandLine, InitiatingProcessFileName
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > TimeRange
    | where FileName in~ ("vssadmin.exe", "wbadmin.exe", "bcdedit.exe") or ActionType == "FileCreated"
    | where FolderPath contains "\\Users\\" or FolderPath contains "\\ProgramData\\"
) on DeviceName, Timestamp
| project Timestamp, DeviceName, AccountName, ProcessName, FilePath, InitiatingProcessFileName
| order by Timestamp desc


powershell
# Rapid Response Hardening & Detection Script
# Checks for exposed RDP, recent scheduled tasks, and VSS status

Write-Host "[+] Starting THEGENTLEMEN T-Minus Hardening Check..." -ForegroundColor Cyan

# 1. Check RDP Exposure (Registry)
$fDenyTS = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -ErrorAction SilentlyContinue).fDenyTSConnections
if ($fDenyTS -eq 0) { Write-Host "[ALERT] RDP is ENABLED. Consider disabling immediately." -ForegroundColor Red } else { Write-Host "[OK] RDP is disabled." -ForegroundColor Green }

# 2. Enumerate Scheduled Tasks created in last 7 days (Persistence)
Write-Host "\n[+] Checking for recently created Scheduled Tasks (Persistence mechanism)..." -ForegroundColor Cyan
$schTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($schTasks) { 
    $schTasks | Format-Table TaskName, Date, Author -AutoSize
    Write-Host "[WARN] Found tasks created in the last 7 days. Review authors." -ForegroundColor Yellow
} else { Write-Host "[OK] No suspicious recent tasks found." -ForegroundColor Green }

# 3. Check Volume Shadow Copy Status (Backup Deletion Check)
Write-Host "\n[+] Checking Volume Shadow Copy Storage usage..." -ForegroundColor Cyan
$vss = vssadmin list shadowstorage /for=c:
Write-Host $vss

# 4. Check for Common Ransomware Extensions/Processes (Basic IOC Check)
$maliciousProcs = @("mimikatz", "procdump", "nc.exe", "plink.exe")
$found = Get-Process | Where-Object { $maliciousProcs -contains $_.ProcessName }
if ($found) { Write-Host "[CRITICAL] Detected suspicious process running!" -ForegroundColor Red; $found } 


# Incident Response Priorities

**T-minus Detection Checklist:**
1.  **VPN Logs:** Immediately audit Check Point Security Gateway logs for successful IKEv1 connections originating from unusual geo-locations (non-CO/US/TW business partners).
2.  **RMM Sessions:** Identify any ScreenConnect sessions initialized without a corresponding ticket number or outside of business hours.
3.  **Firewall Configs:** Check Cisco FMC logs for unauthorized policy changes or deserialization errors (CVE-2026-20131 indicators).

**Critical Assets for Exfiltration:**
THEGENTLEMEN historically prioritizes:
*   **Energy:** SCADA configurations, pipeline schematics, concession contracts.
*   **Logistics:** Ship manifests, personnel data, government contract details.
*   **Healthcare:** Patient PHI (SSN, medical records), insurance billing data.

**Containment Actions (Ordered by Urgency):**
1.  **Isolate:** Disconnect Check Point and Cisco management interfaces from the internet immediately if unpatched.
2.  **Suspend:** Suspend all external remote access (VPN/RMM) accounts; require physical presence for re-enablement.
3.  **Credential Reset:** Force reset of local administrator passwords on all servers and domain admin credentials.

# Hardening Recommendations

**Immediate (24h):**
*   Apply patches for **CVE-2026-50751** and **CVE-2026-20131** to all perimeter security devices.
*   Enforce MFA on all VPN and RMM logins (if not already active).
*   Block internet access to management interfaces of firewalls/VPN concentrators via ACLs.

**Short-term (2 weeks):**
*   Implement network segmentation to separate OT/ICS networks (Ecopetrol/Logistics victims) from IT corporate networks.
*   Deploy EDR rules specifically targeting PsExec and WMI lateral movement from non-admin workstations.
*   Conduct an external penetration test focused on edge perimeter devices.