CVE-2024-7694

TeamT5 ThreatSonar Anti-Ransomware Unrestricted File Upload (CVE-2024-7694)

Initial Access Execution Persistence Last updated:

CVE-2024-7694 is an unrestricted file upload vulnerability (CWE-434) in TeamT5 ThreatSonar Anti-Ransomware. An attacker can upload files with dangerous types to the ThreatSonar management interface, potentially achieving remote code execution on the host running the security product. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation of a security product creates a high-impact scenario where the attacker may gain privileged access to the endpoint security management plane.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
TeamT5
Product
ThreatSonar Anti-Ransomware

Weakness (CWE)

CWE-434

Timeline

Disclosed
February 17, 2026

CVSS

7.2
High (7.0–8.9)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Write-up coming soon

What is CVE-2024-7694 TeamT5 ThreatSonar Anti-Ransomware Unrestricted File Upload (CVE-2024-7694)?

TeamT5 ThreatSonar Anti-Ransomware Unrestricted File Upload (CVE-2024-7694) (CVE-2024-7694) maps to the Initial Access and Execution and Persistence tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for TeamT5 ThreatSonar Anti-Ransomware Unrestricted File Upload (CVE-2024-7694), covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, Microsoft Sentinel, DeviceFileEvents, DeviceNetworkEvents. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence
Microsoft Sentinel / Defender
kusto 
let ThreatSonarPaths = dynamic(['ThreatSonar', 'threatsonar', 'antiransomware']);
let DangerousExtensions = dynamic(['.php', '.asp', '.aspx', '.jsp', '.war', '.exe', '.dll', '.bat', '.cmd', '.ps1', '.sh', '.py', '.rb', '.pl']);
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where ActionType in ('FileCreated', 'FileModified')
| where FolderPath has_any (ThreatSonarPaths) or InitiatingProcessParentFileName has_any (ThreatSonarPaths) or InitiatingProcessFileName has_any (ThreatSonarPaths)
| extend FileExtension = tolower(tostring(split(FileName, '.')[-1]))
| where strcat('.', FileExtension) in (DangerousExtensions)
| project TimeGenerated, DeviceName, DeviceId, FileName, FolderPath, FileExtension, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessParentFileName
| union (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any (ThreatSonarPaths)
    | where RemoteIPType !in ('Private', 'Loopback')
    | where RemotePort !in (80, 443)
    | project TimeGenerated, DeviceName, DeviceId, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
)
| order by TimeGenerated desc

Detects suspicious file creation with dangerous extensions in ThreatSonar-related paths, and anomalous outbound network connections initiated by ThreatSonar processes, which may indicate exploitation of CVE-2024-7694 unrestricted file upload.

critical severity medium confidence

Data Sources

Microsoft Defender for Endpoint Microsoft Sentinel DeviceFileEvents DeviceNetworkEvents

Required Tables

DeviceFileEvents DeviceNetworkEvents

False Positives

  • Legitimate ThreatSonar updates or patches that install executable components
  • Authorized penetration testing activities targeting ThreatSonar
  • ThreatSonar's own threat intelligence update mechanism downloading executable samples for analysis
  • Security researchers uploading test files in lab environments

Sigma rule & cross-platform mapping

The detection logic for TeamT5 ThreatSonar Anti-Ransomware Unrestricted File Upload (CVE-2024-7694) (CVE-2024-7694) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2024-7694 Sigma rules on detection.fyi

Platform-specific guides for CVE-2024-7694

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-06-19 Research depth: standard
References (3)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate web shell upload to ThreatSonar upload directory

    Expected signal: Sysmon Event ID 11 (FileCreate) showing creation of .php file in ThreatSonar path; DeviceFileEvents in MDE showing FileName=test_shell.php in ThreatSonar directory

  2. Test 2Simulate ASP webshell drop via PowerShell (ThreatSonar IIS context)

    Expected signal: Sysmon Event ID 11 with TargetFilename matching *.aspx in wwwroot/threatsonar; IIS log entry if file is subsequently requested

  3. Test 3Simulate post-exploitation cmd.exe spawn from web worker process in ThreatSonar context

    Expected signal: Sysmon Event ID 1 showing cmd.exe spawned from threatsonar_worker.exe process; process tree showing execution of whoami; DeviceProcessEvents in MDE capturing the parent-child process relationship

Response Playbook

Triage

  1. Identify the host running TeamT5 ThreatSonar Anti-Ransomware and confirm the installed version against the vendor advisory at https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/
  2. Review web server or application logs for the ThreatSonar management interface — look for HTTP POST requests to file upload endpoints with dangerous MIME types or extensions (.php, .asp, .aspx, .jsp, .exe, .ps1)
  3. Enumerate files recently created in ThreatSonar installation directories (default: %ProgramFiles%\TeamT5\ThreatSonar or equivalent) with extensions matching web-executable types
  4. Determine whether any suspicious files were executed after creation by correlating file creation timestamps with process execution events
  5. Check for outbound C2 connections or lateral movement originating from the ThreatSonar service account or web server process

Containment

  1. Immediately block network access to the ThreatSonar management web interface at the firewall level to prevent further exploitation — restrict to known administrator IP ranges only
  2. Isolate the affected host from the network using EDR host isolation capabilities if active exploitation or post-exploitation activity is confirmed
  3. Suspend or disable the ThreatSonar web service until a patched version is applied or a compensating control (WAF rule blocking dangerous file uploads) is in place

Evidence Collection

  1. Collect all files created in ThreatSonar directories within the exploitation window, preserving original timestamps, hashes (MD5/SHA256), and file metadata for forensic analysis
  2. Export web server access logs, IIS logs, or equivalent application logs covering the period of the alert — capture full request URIs, source IPs, user agents, HTTP methods, and response codes
  3. Capture a memory image of the ThreatSonar service process and any spawned child processes if active compromise is suspected, before terminating processes

Escalation Criteria

  • ! Escalate to IR team immediately if any uploaded file has been executed — indicated by child processes spawned from the web server or ThreatSonar process after file creation
  • ! Escalate if the compromised host is a security management server with visibility into endpoint telemetry, as an attacker may use this position to blind other security controls or move laterally to managed endpoints

Investigation Guide

Forensic Artifacts

  • > Files with web-executable extensions (.php, .asp, .aspx, .jsp) in ThreatSonar installation directories — hash and submit to threat intelligence platforms
  • > IIS or web server logs showing POST requests to upload endpoints with anomalous Content-Type headers or filenames
  • > Windows Event ID 4688 or Sysmon Event ID 1 showing unexpected child processes spawned by the ThreatSonar service (w3wp.exe, java.exe, or equivalent)
  • > Network connection logs from the ThreatSonar host to external IPs on non-standard ports following file creation events
  • > Windows prefetch files (.pf) or Shimcache entries for any newly created executables in ThreatSonar directories

Tuning Guidance

This detection relies on path-based matching for ThreatSonar directories. If the ThreatSonar installation path is non-default in your environment, update the path patterns accordingly. Reduce false positives by baselining the file types legitimately written to ThreatSonar directories during update windows and excluding known-good update hashes. For higher confidence, add a sequence condition requiring a suspicious process spawn within 10 minutes of the file creation event. If ThreatSonar is running on a dedicated server with no user workload, any outbound connection from ThreatSonar processes to non-TeamT5 IPs should be treated as high-fidelity.

Hunting Queries

Threat hunt for web shell execution patterns — identifies command interpreters launched as children of web server or ThreatSonar processes, which would indicate successful exploitation and post-exploitation activity

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessParentFileName has_any ('w3wp.exe', 'java.exe', 'node.exe', 'python.exe')
| where InitiatingProcessFileName has_any ('ThreatSonar', 'threatsonar', 'antiransomware') or FolderPath has_any ('ThreatSonar', 'threatsonar')
| where FileName in~ ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'python.exe', 'cscript.exe', 'wscript.exe', 'mshta.exe')
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(ParentImage, "(?i)(w3wp|java|node|threatsonar)")
| where match(Image, "(?i)(cmd\.exe|powershell|sh|bash|python|cscript|wscript|mshta)")
| where match(CommandLine, "(?i)(upload|webshell|whoami|net user|wget|curl|certutil)")
| table _time, host, Image, CommandLine, ParentImage, ParentCommandLine, User

Atomic Red Team Tests

Test 1 Simulate web shell upload to ThreatSonar upload directory
windows

Creates a PHP web shell file in a simulated ThreatSonar upload directory to trigger file creation detection rules for CVE-2024-7694

Command

powershell 
New-Item -ItemType Directory -Force -Path 'C:\Program Files\TeamT5\ThreatSonar\uploads' | Out-Null; Set-Content -Path 'C:\Program Files\TeamT5\ThreatSonar\uploads\test_shell.php' -Value '<?php echo shell_exec($_GET["cmd"]); ?>'

Cleanup

powershell 
Remove-Item -Force 'C:\Program Files\TeamT5\ThreatSonar\uploads\test_shell.php' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) showing creation of .php file in ThreatSonar path; DeviceFileEvents in MDE showing FileName=test_shell.php in ThreatSonar directory

Expected Detection

KQL and SPL queries should alert on .php extension file created in ThreatSonar path; Chronicle YARA-L rule should trigger on FILE_CREATION event matching ThreatSonar path pattern

Test 2 Simulate ASP webshell drop via PowerShell (ThreatSonar IIS context)
windows

Creates an ASPX web shell in a simulated ThreatSonar IIS web root directory to validate detection coverage for server-side script execution types

Command

powershell 
New-Item -ItemType Directory -Force -Path 'C:\inetpub\wwwroot\threatsonar' | Out-Null; Set-Content -Path 'C:\inetpub\wwwroot\threatsonar\shell.aspx' -Value '<%@ Page Language="C#" %><% Response.Write(System.Diagnostics.Process.Start(Request["cmd"]).StandardOutput.ReadToEnd()); %>'

Cleanup

powershell 
Remove-Item -Force 'C:\inetpub\wwwroot\threatsonar\shell.aspx' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 with TargetFilename matching *.aspx in wwwroot/threatsonar; IIS log entry if file is subsequently requested

Expected Detection

EQL sequence rule should detect FileCreate with .aspx extension in ThreatSonar-named path; Elastic and Chronicle rules should both fire

Test 3 Simulate post-exploitation cmd.exe spawn from web worker process in ThreatSonar context
windows

Simulates a web shell execution scenario by launching cmd.exe as a child of a renamed process to mimic w3wp.exe spawning a shell after successful file upload exploitation

Command

powershell 
Copy-Item 'C:\Windows\System32\cmd.exe' -Destination 'C:\Temp\threatsonar_worker.exe' -Force; Start-Process 'C:\Temp\threatsonar_worker.exe' -ArgumentList '/c whoami > C:\Temp\threatsonar_exec_output.txt 2>&1' -Wait

Cleanup

powershell 
Remove-Item -Force 'C:\Temp\threatsonar_worker.exe', 'C:\Temp\threatsonar_exec_output.txt' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe spawned from threatsonar_worker.exe process; process tree showing execution of whoami; DeviceProcessEvents in MDE capturing the parent-child process relationship

Expected Detection

Hunting queries for web shell execution patterns should surface this parent-child process relationship; CrowdStrike CQL SyntheticProcessRollup2 events should capture the process creation

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections