ConnectWise ScreenConnect Path Traversal Windows SACL

Try in Splunk Security Cloud

Description

The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability using Windows SACL EventCode 4663. It identifies path traversal attacks by monitoring file system events related to the ScreenConnect service. This activity is significant as it allows unauthorized access to sensitive files and directories, potentially leading to data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access to critical data or execute harmful code, compromising the integrity and security of the affected system. Immediate remediation by updating to version 23.9.8 or above is recommended.

• Type: TTP

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2024-05-20
• Author: Michael Haag, Splunk
• ID: 4e127857-1fc9-4c95-9d69-ba24c91d52d7

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Kill Chain Phase

• Delivery

NIST

• DE.CM

CIS20

• CIS 10

CVE

Search

`wineventlog_security` EventCode=4663  ProcessName=*\\ScreenConnect.Service.exe file_path IN ("*\\ScreenConnect\\App_Extensions\\*") file_name IN ("*.aspx","*.ashx") 
| stats count min(_time) as firstTime max(_time) as lastTime by  ObjectName ObjectType ProcessName AccessMask process_id EventCode Computer Caller_User_Name 
| rename Computer as dest Caller_User_Name as user ProcessName as process_name 
|  `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `connectwise_screenconnect_path_traversal_windows_sacl_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime
• wineventlog_security

connectwise_screenconnect_path_traversal_windows_sacl_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• ObjectName
• ObjectType
• ProcessName
• AccessMask
• process_id
• EventCode
• Computer
• Caller_User_Name

How To Implement

To implement the following query, enable SACL auditing for the ScreenConnect directory(ies). With this data, the following analytic will work correctly. A GIST is provided in the references to assist with enabling SACL Auditing.

Known False Positives

False positives should be limited as the analytic is specific to ScreenConnect path traversal attempts. Tune as needed, or restrict to specific hosts if false positives are encountered.

Associated Analytic Story

• ConnectWise ScreenConnect Vulnerabilities

RBA

Risk Score	Impact	Confidence	Message
100.0	100	100	A path traversal attack against ScreenConnect has been detected on $dest$.

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
• https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
• https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
• https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2