---
title: Potential Check Point VPN IKEv1 Auth Bypass
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 key exchange anomalies or authentication bypass attempts on Check Point Security Gateways.
id: 7b1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
date: 2026/06/19
author: Security Arsenal Research
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: firewall
  service: checkpoint
detection:
  selection:
    product: 'Check Point'
    action: 'key_install' or 'key_exchange'
    protocol: 'ikev1'
  filter:
    src_ip:
      - '127.0.0.1'
      - '::1'
  condition: selection and not filter
falsepositives:
  - Legitimate IKEv1 VPN rekeying from known corporate IPs
level: high
---
title: Suspicious Cobalt Strike PowerShell Execution
description: Detects PowerShell execution patterns commonly used by Cobalt Strike beacons, a frequent lateral movement tool for ransomware groups.
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
date: 2026/06/19
author: Security Arsenal Research
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: '\powershell.exe'
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
      - 'DownloadString'
    ParentProcessName|endswith:
      - '\wmiprvse.exe'
      - '\svchost.exe'
      - '\rundll32.exe'
  condition: selection
falsepositives:
  - System administration scripts
level: high
---
title: Mass Data Staging via Rclone
description: Detects the execution of rclone.exe with parameters indicative of data exfiltration to cloud storage, common in double-extortion attacks.
id: f1e2d3c4-b5a6-9876-fedc-ba9876543210
status: experimental
date: 2026/06/19
author: Security Arsenal Research
logsource:
  product: windows
  service: process_creation
detection:
  selection:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'megacopy'
  condition: selection
falsepositives:
  - Legitimate backup operations using rclone
level: critical

// Hunt for lateral movement using WMI and PsExec often used by ransomware
let ProcessCreationEvents = SecurityEvent
| where EventID == 4688
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName;
ProcessCreationEvents
| where NewProcessName endswith "\\wmiprvse.exe" or NewProcessName endswith "\\psexec.exe" or NewProcessName endswith "\\psexec64.exe"
| where CommandLine contains "-enc" or CommandLine contains "Interactive" or CommandLine contains "accepteula"
| summarize count() by Computer, Account, NewProcessName, bin(TimeGenerated, 5m)
| order by count_ desc

# Check for recent Scheduled Tasks (Persistence) and VSS Shadow Copy changes
Write-Host "Checking for suspicious Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
$Date = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $Date} | Select-Object TaskName, Author, LastRunTime, Actions

Write-Host "Checking Volume Shadow Copy Service status..." -ForegroundColor Yellow
Get-WmiObject -Class Win32_ShadowCopy | ForEach-Object {
    [PSCustomObject]@{
        Volume = $_.DeviceObject
        Installed = $_.InstallDate
        State = if ($_.Status -eq 'Valid') { 'OK' } else { 'CRITICAL' }
    }
}

Write-Host "Enumerating exposed RDP ports (checking for listening on 3389)..." -ForegroundColor Yellow
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress, OwningProcess


# Incident Response Priorities

**T-minus Detection Checklist (Pre-Encryption):**
1.  **Edge Log Audit:** Immediately review logs for Check Point Security Gateways (IKEv1 anomalies) and Cisco FMC for unauthorized access attempts around 2026-06-08 to present.
2.  **ScreenConnect Audit:** If running ConnectWise ScreenConnect, check for web log anomalies matching CVE-2024-1708.
3.  **Process Hunter:** Scan endpoints for `rclone.exe`, `powershell.exe` spawned by `wmiprvse.exe`, or unexpected `PsExec` usage.

**Critical Assets for Exfiltration:**
THEGENTLEMEN prioritize intellectual property and client databases. Focus containment efforts on:
*   CAD/PLM servers (Manufacturing)
*   SCADA/OT interface servers (Energy)
*   HR and Financial databases (All sectors)

**Containment Actions:**
1.  **Isolate:** Disconnect VPN concentrators and management interfaces (Cisco FMC) from the network if compromise is suspected.
2.  **Revoke:** Reset credentials for service accounts and local administrators on critical servers.
3.  **Block:** Sinkhole known C2 domains associated with this campaign at the perimeter firewall.

# Hardening Recommendations

**Immediate (24h):**
*   **Patch:** Apply updates for **CVE-2026-50751** (Check Point) and **CVE-2026-20131** (Cisco FMC) immediately.
*   **Configure:** Disable IKEv1 on Check Point gateways if not strictly required for legacy support.
*   **Access Control:** Enforce MFA on all VPN and remote management access (ScreenConnect, RDP).

**Short-term (2 weeks):**
*   **Segmentation:** Implement strict network segmentation to separate OT/IoT networks from IT corporate networks, specifically for Manufacturing and Energy victims.
*   **EDR Deployment:** Ensure comprehensive EDR coverage is active on all management servers and jump hosts.
*   **Backup Vaulting:** Move immutable backups offline or to an air-gapped environment to counter double extortion tactics.