Try in Splunk Security Cloud

Description

This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability utilizing Windows SACL EventCode 4663, which allows an attacker to perform path traversal attacks by manipulating the file_path and file_name parameters in the URL. The vulnerability, identified as critical with a CVSS score of 9.8, enables unauthorized users to access sensitive files and directories on the host system, potentially leading to the exfiltration of sensitive data or the execution of arbitrary code. The search query provided looks for file system events that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.

  • Type: TTP

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2024-02-21
  • Author: Michael Haag, Splunk
  • ID: 4e127857-1fc9-4c95-9d69-ba24c91d52d7

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1190 Exploit Public-Facing Application Initial Access
Kill Chain Phase
  • Delivery
NIST
  • DE.CM
CIS20
  • CIS 10
CVE
ID Summary CVSS
CVE-2024-1708 ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker  

the ability to execute remote code or directly impact confidential data or critical systems.

None  
CVE-2024-1709 ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel

vulnerability, which may allow an attacker direct access to confidential information or

critical systems.

None 


1
2
3
4
5
6



`wineventlog_security` EventCode=4663  ProcessName=*\\ScreenConnect.Service.exe file_path IN ("*\\ScreenConnect\\App_Extensions\\*") file_name IN ("*.aspx","*.ashx") 
| stats count min(_time) as firstTime max(_time) as lastTime by  ObjectName ObjectType ProcessName AccessMask process_id EventCode Computer Caller_User_Name 
| rename Computer as dest Caller_User_Name as user ProcessName as process_name 
|  `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `connectwise_screenconnect_path_traversal_windows_sacl_filter`

Macros

The SPL above uses the following Macros:

:information_source: connectwise_screenconnect_path_traversal_windows_sacl_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • ObjectName
  • ObjectType
  • ProcessName
  • AccessMask
  • process_id
  • EventCode
  • Computer
  • Caller_User_Name

How To Implement

To implement the following query, enable SACL auditing for the ScreenConnect directory(ies). With this data, the following analytic will work correctly. A GIST is provided in the references to assist with enabling SACL Auditing.

Known False Positives

False positives should be limited as the analytic is specific to ScreenConnect path traversal attempts. Tune as needed, or restrict to specific hosts if false positives are encountered.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
100.0 100 100 A path traversal attack against ScreenConnect has been detected on $dest$.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1