deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: ScreenConnect User Database Modification - Security
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Matt Anderson, Kris Luzadre, Andrew Schwartz, Huntress
Date: 2024-02-20
Log source: windows/

Description:
This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server.
This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.
This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.


Detection logic:
{
  "selection": {
    "EventID": 4663,
    "ObjectType": "File",
    "AccessMask": "0x6",
    "ObjectName|endswith": ".xml",
    "ObjectName|contains|all": [
      "Temp",
      "ScreenConnect"
    ],
    "ProcessName|contains": "ScreenConnect.Service.exe"
  },
  "condition": "selection"
}

References:
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://www.cve.org/CVERecord?id=CVE-2024-1709
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Sigma Detection Rule: CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Matt Anderson, Huntress
Date: 2024-02-20
Log source: /webserver

Description:
Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.


Detection logic:
{
  "selection": {
    "cs-uri-stem|contains": "/SetupWizard.aspx/"
  },
  "condition": "selection"
}

References:
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
  - https://www.cve.org/CVERecord?id=CVE-2024-1709
Sigma Detection Rule: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2024-04-25
Log source: paloalto/file_event

Description:
Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled.
As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "{IFS}",
      "base64",
      "bash",
      "curl",
      "http"
    ],
    "TargetFilename|startswith": "/opt/panlogs/tmp/device_telemetry/"
  },
  "condition": "selection"
}

References:
  - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
  - https://nvd.nist.gov/vuln/detail/CVE-2024-3400
Sigma Detection Rule: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-04-18
Log source: paloalto/appliance

Description:
Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect.
This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.


Detection logic:
{
  "keywords_generic": [
    "failed to unmarshal session(../",
    "failed to unmarshal session(./../",
    "failed to unmarshal session(/..",
    "failed to unmarshal session(%2E%2E%2F",
    "failed to unmarshal session(%2F%2E%2E",
    "failed to unmarshal session(%2E%2F%2E%2E%2F",
    "failed to unmarshal session(%252E%252E%252F",
    "failed to unmarshal session(%252F%252E%252E",
    "failed to unmarshal session(%252E%252F%252E%252E%252F"
  ],
  "keywords_telemetry_exploit": [
    "{IFS}",
    "base64",
    "bash",
    "curl",
    "http"
  ],
  "keywords_telemetry_path": [
    "/opt/panlogs/tmp/device_telemetry/"
  ],
  "condition": "keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)"
}

References:
  - https://security.paloaltonetworks.com/CVE-2024-3400
  - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
  - https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis
Sigma Detection Rule: CVE-2024-1708 - ScreenConnect Path Traversal Exploitation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress
Date: 2024-02-21
Log source: windows/file_event

Description:
This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\ScreenConnect.Service.exe",
    "TargetFilename|endswith": [
      "ScreenConnect\\\\App_Extensions\\\\*.ashx",
      "ScreenConnect\\\\App_Extensions\\\\*.aspx"
    ]
  },
  "filter_main_legit_extension": {
    "TargetFilename|contains": "ScreenConnect\\App_Extensions\\\\*\\\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://www.cve.org/CVERecord?id=CVE-2024-1709
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Sigma Detection Rule: CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Matt Anderson, Caleb Stewart, Huntress
Date: 2024-02-20
Log source: windows/

Description:
This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.
This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.


Detection logic:
{
  "selection": {
    "EventID": 4663,
    "ObjectType": "File",
    "ProcessName|contains": "ScreenConnect.Service.exe",
    "AccessMask": "0x6",
    "ObjectName|endswith": [
      "ScreenConnect\\\\App_Extensions\\\\*.ashx",
      "ScreenConnect\\\\App_Extensions\\\\*.aspx"
    ]
  },
  "filter_main_legit_extension": {
    "ObjectName|contains": "ScreenConnect\\App_Extensions\\\\*\\\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://www.cve.org/CVERecord?id=CVE-2024-1708
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Sigma Detection Rule: CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-03-20
Log source: /webserver

Description:
Detects potential exploitation of CVE-2024-1709 an unauthenticated command injection in Progress Kemp LoadMaster.
It looks for GET requests to '/access/set' API with the parameters 'param=enableapi' and 'value=1' as well as an "Authorization" header with a base64 encoded value with an uncommon character.


Detection logic:
{
  "selection_path": {
    "cs-method": "GET",
    "cs-uri-stem|contains|all": [
      "/access/set",
      "param=enableapi",
      "value=1"
    ]
  },
  "selection_keywords": [
    "Basic Jz",
    "Basic c7",
    "Basic nO",
    "Basic ';"
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/RhinoSecurityLabs/CVEs/blob/15cf4d86c83daa57b59eaa2542a0ed47ad3dc32d/CVE-2024-1212/CVE-2024-1212.py
  - https://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/
Sigma Detection Rule: CVE-2024-50623 Exploitation Attempt - Cleo
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson
Date: 2024-12-09
ATT&CK techniques: T1190
Log source: windows/process_creation

Description:
Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\javaw.exe",
    "ParentCommandLine|contains": [
      "Harmony",
      "lexicom",
      "VersaLex",
      "VLTrader"
    ],
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": [
      "powershell",
      " -enc ",
      " -EncodedCommand",
      ".Download"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
Sigma Detection Rule: CVE-2024-49113 Exploitation Attempt - LDAP Nightmare
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Samuel Monsempes
Date: 2025-01-08
ATT&CK techniques: T1499
Log source: windows/

Description:
Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".


Detection logic:
{
  "selection": {
    "Provider_Name": "Application Error",
    "EventID": 1000,
    "Data|contains|all": [
      "lsass.exe",
      "WLDAP32.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
  - https://www.linkedin.com/feed/update/urn:li:activity:[PII_REDACTED]792605698/
Sigma Detection Rule: Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Arnim Rupp, Nasreddine Bencherchali, Thomas Patzke
Date: 2024-04-01
Log source: linux/process_creation

Description:
Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "/sshd",
    "CommandLine|startswith": [
      "bash -c",
      "sh -c"
    ],
    "User": "root"
  },
  "condition": "selection"
}

References:
  - https://github.com/amlweems/xzbot?tab=readme-ov-file#backdoor-demo
Sigma Detection Rule: Potential CVE-2024-35250 Exploitation Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: @eyezuhk Isaac Fernandes
Date: 2025-02-19
ATT&CK techniques: T1068
Log source: windows/image_load

Description:
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\ksproxy.ax"
  },
  "filter_main_system_paths": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_teams": {
    "Image|endswith": "\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe"
  },
  "filter_optional_zoom": {
    "Image|endswith": "\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe"
  },
  "filter_optional_firefox": {
    "Image|endswith": "\\AppData\\Local\\Mozilla Firefox\\firefox.exe"
  },
  "filter_optional_chrome": {
    "Image|endswith": "\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe"
  },
  "filter_optional_opera": {
    "Image|endswith": "\\AppData\\Local\\Programs\\Opera\\opera.exe"
  },
  "filter_optional_discord": {
    "Image|endswith": "\\AppData\\Local\\Discord\\app-*\\Discord.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
  - https://github.com/varwara/CVE-2024-35250
  - https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Sigma Detection Rule: Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2024-07-29
Log source: windows/process_creation

Description:
Detects execution of the "net.exe" command in order to add a group named "ESX Admins".
This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor.
VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.


Detection logic:
{
  "selection_net_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_net_cmd": {
    "CommandLine|contains|all": [
      "/add",
      "/domain",
      "ESX Admins",
      "group"
    ]
  },
  "selection_powershell_img": [
    {
      "Image|endswith": [
        "\\PowerShell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.exe",
        "pwsh.dll"
      ]
    }
  ],
  "selection_powershell_cli": {
    "CommandLine|contains|all": [
      "New-ADGroup",
      "ESX Admins"
    ]
  },
  "condition": "all of selection_net_* or all of selection_powershell_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
Sigma Detection Rule: Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-30
Log source: windows/

Description:
Detects any creation or modification to a windows domain group with the name "ESX Admins".
This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor.
VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.


Detection logic:
{
  "selection": {
    "EventID": [
      4727,
      4728,
      4731,
      4737,
      4754,
      4755,
      4756
    ]
  },
  "keyword_group": [
    "ESX Admins"
  ],
  "condition": "selection and keyword_group"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
Sigma Detection Rule: DPRK Threat Actor - C2 Communication DNS Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-20
Log source: windows/dns_query

Description:
Detects DNS queries for C2 domains used by DPRK Threat actors.

Detection logic:
{
  "selection": {
    "QueryName": [
      "connection.lockscreen.kro.kr",
      "updating.dothome.co.kr"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2024-02-19-joint-cyber-security-advisory-englisch.pdf?__blob=publicationFile&v=2
Sigma Detection Rule: Potential APT FIN7 Exploitation Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Alex Walston (@4ayymm)
Date: 2024-07-29
ATT&CK techniques: T1059.001, T1059.003
Log source: windows/process_creation

Description:
Detects potential APT FIN7 exploitation activity as reported by Google.
In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.


Detection logic:
{
  "selection_notepad_plus": {
    "ParentImage|endswith": "\\notepad++.exe",
    "Image|endswith": "\\cmd.exe"
  },
  "selection_rdpinit": {
    "ParentImage|endswith": "\\rdpinit.exe",
    "Image|endswith": "\\notepad++.exe"
  },
  "condition": "1 of selection_*"
}

References:
  - https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
Sigma Detection Rule: Forest Blizzard APT - JavaScript Constrained File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-04-23
ATT&CK techniques: T1685.001
Log source: windows/file_event

Description:
Detects the creation of JavaScript files inside of the DriverStore directory.
Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.


Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\System32\\DriverStore\\FileRepository\\",
    "TargetFilename|endswith": "\\.js"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
Sigma Detection Rule: Forest Blizzard APT - Process Creation Activity
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-04-23
Log source: windows/process_creation

Description:
Detects the execution of specific processes and command line combination.
These were seen being created by Forest Blizzard as described by MSFT.


Detection logic:
{
  "selection_hashes": {
    "Hashes|contains": [
      "SHA256=6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f",
      "SHA256=c60ead92cd376b689d1b4450f2578b36ea0bf64f3963cfa5546279fa4424c2a5"
    ]
  },
  "selection_schtasks_create": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      "Create",
      "/RU",
      "SYSTEM",
      "\\Microsoft\\Windows\\WinSrv"
    ],
    "CommandLine|contains": [
      "servtask.bat",
      "execute.bat",
      "doit.bat"
    ]
  },
  "selection_schtasks_delete": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      "Delete",
      "/F ",
      "\\Microsoft\\Windows\\WinSrv"
    ]
  },
  "selection_powershell": {
    "CommandLine|contains|all": [
      "Get-ChildItem",
      ".save",
      "Compress-Archive -DestinationPath C:\\ProgramData\\"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
Sigma Detection Rule: Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-04-23
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects the setting of the DLL that handles the custom protocol handler.
Seen being created by Forest Blizzard APT as reported by MSFT.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\CLSID\\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}\\Server",
    "Details|endswith": ".dll"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
Sigma Detection Rule: Forest Blizzard APT - Custom Protocol Handler Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-04-23
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects the setting of a custom protocol handler with the name "rogue".
Seen being created by Forest Blizzard APT as reported by MSFT.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\PROTOCOLS\\\\Handler\\rogue\\CLSID",
    "Details": "{026CC6D7-34B2-33D5-B551-CA31EB6CE345}"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
Sigma Detection Rule: Forest Blizzard APT - File Creation Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-04-23
ATT&CK techniques: T1685.001
Log source: windows/file_event

Description:
Detects the creation of specific files inside of ProgramData directory.
These files were seen being created by Forest Blizzard as described by MSFT.


Detection logic:
{
  "selection_programdata_driver_store": {
    "TargetFilename|startswith": [
      "C:\\ProgramData\\Microsoft\\v",
      "C:\\ProgramData\\Adobe\\v",
      "C:\\ProgramData\\Comms\\v",
      "C:\\ProgramData\\Intel\\v",
      "C:\\ProgramData\\Kaspersky Lab\\v",
      "C:\\ProgramData\\Bitdefender\\v",
      "C:\\ProgramData\\ESET\\v",
      "C:\\ProgramData\\NVIDIA\\v",
      "C:\\ProgramData\\UbiSoft\\v",
      "C:\\ProgramData\\Steam\\v"
    ],
    "TargetFilename|contains": [
      "\\prnms003.inf_",
      "\\prnms009.inf_"
    ]
  },
  "selection_programdata_main": {
    "TargetFilename|startswith": "C:\\ProgramData\\"
  },
  "selection_programdata_files_1": {
    "TargetFilename|endswith": [
      ".save",
      "\\doit.bat",
      "\\execute.bat",
      "\\servtask.bat"
    ]
  },
  "selection_programdata_files_2": {
    "TargetFilename|contains": "\\wayzgoose",
    "TargetFilename|endswith": ".dll"
  },
  "condition": "selection_programdata_driver_store or (selection_programdata_main and 1 of selection_programdata_files_*)"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
Sigma Detection Rule: ScreenConnect - SlashAndGrab Exploitation Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-23
Log source: windows/file_event

Description:
Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect as reported Team Huntress


Detection logic:
{
  "selection": [
    {
      "TargetFilename|contains|all": [
        "C:\\Windows\\Temp\\ScreenConnect\\",
        "\\LB3.exe"
      ]
    },
    {
      "TargetFilename|contains": [
        "C:\\mpyutd.msi",
        "C:\\perflogs\\RunSchedulerTaskOnce.ps1",
        "C:\\ProgramData\\1.msi",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mpyutd.msi",
        "C:\\ProgramData\\update.dat",
        "C:\\Users\\oldadmin\\Documents\\MilsoftConnect\\Files\\ta.exe",
        "C:\\Windows\\Help\\Help\\SentinelAgentCore.dll",
        "C:\\Windows\\Help\\Help\\SentinelUI.exe",
        "C:\\Windows\\spsrv.exe",
        "C:\\Windows\\Temp\\svchost.exe"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708