ConnectWise ScreenConnect Path Traversal (CVE-2024-1708)

let ScreenConnectProcesses = DeviceProcessEvents
| where FileName in~ ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")
| project DeviceId, DeviceName, SC_PID = ProcessId, SC_ProcessName = FileName, SC_CommandLine = ProcessCommandLine, TimeGenerated;
let SuspiciousChildren = DeviceProcessEvents
| where InitiatingProcessFileName in~ ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe")
| project DeviceId, DeviceName, TimeGenerated, ChildProcess = FileName, ChildCommandLine = ProcessCommandLine, ParentProcess = InitiatingProcessFileName;
let PathTraversalRequests = DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe")
| project DeviceId, TimeGenerated, RemoteIP, RemotePort, InitiatingProcessFileName;
union SuspiciousChildren, PathTraversalRequests
| summarize count() by DeviceName, DeviceId, bin(TimeGenerated, 1h)
| where count_ > 0

index=windows (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval parent_proc=lower(ParentImage), child_proc=lower(Image), cmdline=lower(CommandLine)
| where (parent_proc LIKE "%screenconnect%")
  AND (child_proc LIKE "%cmd.exe" OR child_proc LIKE "%powershell.exe" OR child_proc LIKE "%wscript.exe" OR child_proc LIKE "%cscript.exe" OR child_proc LIKE "%mshta.exe" OR child_proc LIKE "%certutil.exe" OR child_proc LIKE "%curl.exe")
| eval traversal_indicator=if(like(cmdline,"%..\..\.."%") OR like(cmdline,"%../%"),1,0)
| stats count, values(cmdline) as CommandLines, values(child_proc) as ChildProcesses, dc(host) as HostCount by parent_proc, user, earliest(_time), latest(_time)
| where count > 0
| eval risk_score=case(traversal_indicator=1, 95, HostCount > 3, 85, true(), 70)
| sort -risk_score

sequence by host.id with maxspan=5m
  [process where event.type == "start"
    and process.name : ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")]
  [process where event.type == "start"
    and process.parent.name : ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "net.exe", "whoami.exe", "ipconfig.exe")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, username, QIDNAME(qid) AS EventName, processname, parentprocessname, commandline
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (LOWER(parentprocessname) LIKE '%screenconnect%')
  AND (LOWER(processname) IN ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'certutil.exe', 'curl.exe', 'net.exe', 'whoami.exe'))
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| parse field=message "ParentImage: *" as parent_image nodrop
| parse field=message "Image: *" as child_image nodrop
| parse field=message "CommandLine: *" as command_line nodrop
| where toLowerCase(parent_image) matches "*screenconnect*"
| where toLowerCase(child_image) matches "*cmd.exe*" OR toLowerCase(child_image) matches "*powershell.exe*" OR toLowerCase(child_image) matches "*wscript.exe*" OR toLowerCase(child_image) matches "*certutil.exe*" OR toLowerCase(child_image) matches "*curl.exe*" OR toLowerCase(child_image) matches "*mshta.exe*"
| count by _sourceHost, parent_image, child_image, command_line
| sort by _count desc

rule connectwise_screenconnect_path_traversal_cve_2024_1708 {
  meta:
    author = "df00tech"
    description = "Detects CVE-2024-1708 ScreenConnect path traversal exploitation via suspicious child process spawning"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1708"

  events:
    $parent.metadata.event_type = "PROCESS_LAUNCH"
    $parent.principal.process.file.full_path = /(?i)screenconnect/
    $child.metadata.event_type = "PROCESS_LAUNCH"
    $child.principal.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|curl\.exe|bitsadmin\.exe)/
    $child.principal.process.parent_process.file.full_path = $parent.principal.process.file.full_path
    $parent.metadata.collected_timestamp.seconds = $child.metadata.collected_timestamp.seconds

  match:
    $child.principal.hostname over 5m

  condition:
    $parent and $child
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")
| FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "curl.exe", "bitsadmin.exe", "net.exe", "whoami.exe", "ipconfig.exe")
| stats count() by ComputerName, UserName, ParentBaseFileName, FileName, CommandLine
| sort count asc