Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
16
5
1
Contributors
16
5
1
Categories
10
8
5
3
2
Platforms
18
4
1
Products / Services
9
8
4
2
2
MITRE Techniques
9
8
7
6
6
CVEs
71
71
64
58
49
22
IDS Classtypes
1
IDS Protocols
1
This rule detects an exploitation attempt targeting the ConnectWise ScreenConnect Path Traversal vulnerability (CVE-2024-1708). The detection monitors incoming HTTP traffic for attempts to traverse the file system by inspecting the URI for repeated '..' sequences within the '/App_Extensions/' directory, a hallmark of this vulnerability.
The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via alternate paths or channels. It leverages Nginx access logs to identify web requests to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected ScreenConnect instance, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe
Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI.
An example would be a threat actor creating a new user via the net command and providing the password inline
An example would be a threat actor creating a new user via the net command and providing the password inline
This rule detects attempts to add users to highly privileged groups on Windows systems. It specifically looks for command-line executions of 'net localgroup <groupname> /add' or 'Add-LocalGroupMember -Group <groupname>' where the group name is either 'Group Policy Creator Owners' or 'Schema Admins'. These groups are considered highly privileged, and unauthorized additions could indicate privilege escalation or persistence.
The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via alternate paths or channels. It leverages Nginx access logs to identify web requests to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected ScreenConnect instance, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
This rule detects the use of PowerShell (powershell.exe or pwsh.exe) to download files from known file-sharing or content delivery network (CDN) domains. It specifically looks for command-line arguments indicative of file download operations, such as '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', and 'wget'. The rule aims to identify suspicious activity where PowerShell is leveraged to retrieve potentially malicious payloads from untrusted or commonly abused online services.
This rule detects the execution of SimpleHelp remote access software. SimpleHelp is a legitimate desktop support and remote access tool that adversaries may abuse to establish command and control (C2) channels. The rule specifically looks for process creation events where the image path contains "JWrapper-Remote Access" or "JWrapper-Remote Support" and the executable name is "SimpleService.exe". This pattern indicates the execution of the SimpleHelp service component.
Detects potentially suspicious child processes launched via the ScreenConnect client service. This rule specifically looks for common Windows utilities being executed from a temporary ScreenConnect directory, which can indicate post-exploitation activity by an adversary using the remote access tool.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects potentially suspicious child processes launched via the ScreenConnect client service.
This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability using Windows SACL EventCode 4663. It identifies path traversal attacks by monitoring file system events related to the ScreenConnect service. This activity is significant as it allows unauthorized access to sensitive files and directories, potentially leading to data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access to critical data or execute harmful code, compromising the integrity and security of the affected system. Immediate remediation by updating to version 23.9.8 or above is recommended.
This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability, which allows path traversal attacks by manipulating file_path and file_name parameters in the URL. It leverages the Endpoint datamodel Filesystem node to identify suspicious file system events, specifically targeting paths and filenames associated with ScreenConnect. This activity is significant as it can lead to unauthorized access to sensitive files and directories, potentially resulting in data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access and control over the host system, posing a severe security risk.
The analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via an alternate path or channel. It leverages web request logs to identify access to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected system, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
This rule detects file modifications to ASPX and ASHX files within the root of the 'App_Extensions' directory by the 'ScreenConnect.Service.exe' process. This activity is indicative of exploitation of CVE-2024-1708, a ZipSlip vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8, which allows for path traversal and arbitrary file write.
This rule detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is indicative of exploitation of CVE-2024-1708, a path traversal vulnerability (ZipSlip) in ConnectWise ScreenConnect versions prior to 23.9.8. The detection relies on Windows Event ID 4663 (File System) with a SACL set on the directory to log successful access attempts.
Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect (ConnectWise) as reported by Team Huntress. This rule specifically looks for the creation of known malicious files and paths associated with post-exploitation activities after successful exploitation of CVE-2024-1709 and CVE-2024-1708.
Detects remote binary or command execution via the ScreenConnect Service. This rule is intended for hunting anomalous executions originating from ScreenConnect, which is a legitimate remote administration tool that can be abused by threat actors.
Detects suspicious patterns in PowerShell command lines that indicate the use of `Invoke-Expression` (IEX) for potentially malicious code execution. This rule looks for various obfuscated or unusual ways IEX might be invoked, often in conjunction with base64 encoded strings, to execute arbitrary commands or scripts.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
Page 1 of 2