CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•1•0•24

This rule detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is indicative of exploitation of CVE-2024-1708, a path traversal vulnerability (ZipSlip) in ConnectWise ScreenConnect versions prior to 23.9.8. The detection relies on Windows Event ID 4663 (File System) with a SACL set on the directory to log successful access attempts.