Detect ConnectWise ScreenConnect Path Traversal (CVE-2024-1708) in Microsoft Sentinel
Detects exploitation of CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8. Attackers can traverse outside the intended directory to read, write, or execute arbitrary files on the host. This vulnerability is actively exploited in the wild and listed on CISA KEV. It is commonly chained with CVE-2024-1709 (authentication bypass) to achieve unauthenticated remote code execution.
MITRE ATT&CK
KQL Detection Query
let ScreenConnectProcesses = DeviceProcessEvents
| where FileName in~ ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")
| project DeviceId, DeviceName, SC_PID = ProcessId, SC_ProcessName = FileName, SC_CommandLine = ProcessCommandLine, TimeGenerated;
let SuspiciousChildren = DeviceProcessEvents
| where InitiatingProcessFileName in~ ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe")
| project DeviceId, DeviceName, TimeGenerated, ChildProcess = FileName, ChildCommandLine = ProcessCommandLine, ParentProcess = InitiatingProcessFileName;
let PathTraversalRequests = DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe")
| project DeviceId, TimeGenerated, RemoteIP, RemotePort, InitiatingProcessFileName;
union SuspiciousChildren, PathTraversalRequests
| summarize count() by DeviceName, DeviceId, bin(TimeGenerated, 1h)
| where count_ > 0Detects ScreenConnect processes spawning suspicious child processes (indicative of post-exploitation via path traversal RCE) and unusual outbound network activity from ScreenConnect service processes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT administrators running scripts via ScreenConnect remote sessions
- Automated patching or deployment tools invoked through ScreenConnect
- Security scanning tools that spawn command interpreters as part of normal operation
Other platforms for CVE-2024-1708
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Path Traversal File Read via ScreenConnect Web Interface
Expected signal: HTTP 200 or 500 response logged in IIS access logs with traversal sequence in URI; network traffic from test host to ScreenConnect port 8040.
- Test 2ScreenConnect Child Process Spawn Simulation (Sysmon)
Expected signal: Sysmon Event ID 1 with Image: cmd.exe and ParentImage set to ScreenConnect service path (in actual exploitation scenario); Event ID 11 for file creation.
- Test 3Post-Exploitation Download Cradle via ScreenConnect Session
Expected signal: Sysmon Event ID 1 (PowerShell spawned from ScreenConnect parent), Event ID 3 (network connection to LAB_C2_HOST), Event ID 7 (System.Net.WebClient DLL load).
Unlock Pro Content
Get the full detection package for CVE-2024-1708 including response playbook, investigation guide, and atomic red team tests.