CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•1•0•29

This rule detects file modifications to ASPX and ASHX files within the root of the 'App_Extensions' directory by the 'ScreenConnect.Service.exe' process. This activity is indicative of exploitation of CVE-2024-1708, a ZipSlip vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8, which allows for path traversal and arbitrary file write.