/
connectwise_screenconnect_path_traversal_windows_sacl.yml
61 lines (61 loc) · 3.46 KB
/
connectwise_screenconnect_path_traversal_windows_sacl.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
name: ConnectWise ScreenConnect Path Traversal Windows SACL
id: 4e127857-1fc9-4c95-9d69-ba24c91d52d7
version: 1
date: '2024-02-21'
author: Michael Haag, Splunk
data_source:
- Windows Event Log Security 4663
type: TTP
status: production
description: This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability utilizing Windows SACL EventCode 4663, which allows an attacker to perform path traversal attacks by manipulating the file_path and file_name parameters in the URL. The vulnerability, identified as critical with a CVSS score of 9.8, enables unauthorized users to access sensitive files and directories on the host system, potentially leading to the exfiltration of sensitive data or the execution of arbitrary code. The search query provided looks for file system events that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
search: '`wineventlog_security` EventCode=4663 ProcessName=*\\ScreenConnect.Service.exe file_path IN ("*\\ScreenConnect\\App_Extensions\\*") file_name IN ("*.aspx","*.ashx")
| stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType ProcessName AccessMask process_id EventCode Computer Caller_User_Name
| rename Computer as dest Caller_User_Name as user ProcessName as process_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `connectwise_screenconnect_path_traversal_windows_sacl_filter`'
how_to_implement: To implement the following query, enable SACL auditing for the ScreenConnect directory(ies). With this data, the following analytic will work correctly. A GIST is provided in the references to assist with enabling SACL Auditing.
known_false_positives: False positives should be limited as the analytic is specific to ScreenConnect path traversal attempts. Tune as needed, or restrict to specific hosts if false positives are encountered.
references:
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
tags:
analytic_story:
- ConnectWise ScreenConnect Vulnerabilities
asset_type: Endpoint
confidence: 100
impact: 100
message: A path traversal attack against ScreenConnect has been detected on $dest$.
mitre_attack_id:
- T1190
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- ObjectName
- ObjectType
- ProcessName
- AccessMask
- process_id
- EventCode
- Computer
- Caller_User_Name
risk_score: 100
security_domain: endpoint
cve:
- CVE-2024-1708
- CVE-2024-1709
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/4663_connectwise_aspx_app_extensions.log
sourcetype: XmlWinEventLog
source: XmlWinEventLog:Security