CVE-2024-7694 Splunk · SPL

Detect TeamT5 ThreatSonar Anti-Ransomware Unrestricted File Upload (CVE-2024-7694) in Splunk

CVE-2024-7694 is an unrestricted file upload vulnerability (CWE-434) in TeamT5 ThreatSonar Anti-Ransomware. An attacker can upload files with dangerous types to the ThreatSonar management interface, potentially achieving remote code execution on the host running the security product. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation of a security product creates a high-impact scenario where the attacker may gain privileged access to the endpoint security management plane.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

SPL Detection Query

Splunk (SPL)
spl 
index=endpoint OR index=wineventlog sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security", "crowdstrike:events:sensor")
| eval file_path=coalesce(TargetFilename, file_path, FilePath)
| eval process_name=coalesce(Image, process_name, ProcessName)
| eval cmd_line=coalesce(CommandLine, cmd_line, process_cmd_line)
| where match(file_path, "(?i)(threatsonar|antiransomware|teamt5)")
    OR match(process_name, "(?i)(threatsonar|antiransomware)")
| eval file_ext=lower(mvindex(split(file_path, "."), -1))
| where file_ext IN ("php", "asp", "aspx", "jsp", "war", "exe", "dll", "bat", "cmd", "ps1", "sh", "py", "rb", "pl")
| eval risk_score=case(
    file_ext IN ("php", "asp", "aspx", "jsp"), 90,
    file_ext IN ("exe", "dll"), 80,
    file_ext IN ("ps1", "bat", "cmd", "sh"), 70,
    true(), 60
  )
| table _time, host, file_path, file_ext, process_name, cmd_line, user, risk_score
| sort -risk_score, -_time
critical severity medium confidence

Detects file creation events with dangerous extensions in ThreatSonar Anti-Ransomware directories via Sysmon or EDR telemetry, indicating potential exploitation of the unrestricted file upload vulnerability CVE-2024-7694.

Data Sources

SysmonCrowdStrike FalconWindows Security Event Log

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Securitycrowdstrike:events:sensor

False Positives & Tuning

  • Legitimate software updates deploying executables in ThreatSonar directories
  • Authorized security testing activities
  • ThreatSonar's internal quarantine mechanism storing executable malware samples
  • False path matches on directories with similar naming conventions

Other platforms for CVE-2024-7694

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate web shell upload to ThreatSonar upload directory

    Expected signal: Sysmon Event ID 11 (FileCreate) showing creation of .php file in ThreatSonar path; DeviceFileEvents in MDE showing FileName=test_shell.php in ThreatSonar directory

  2. Test 2Simulate ASP webshell drop via PowerShell (ThreatSonar IIS context)

    Expected signal: Sysmon Event ID 11 with TargetFilename matching *.aspx in wwwroot/threatsonar; IIS log entry if file is subsequently requested

  3. Test 3Simulate post-exploitation cmd.exe spawn from web worker process in ThreatSonar context

    Expected signal: Sysmon Event ID 1 showing cmd.exe spawned from threatsonar_worker.exe process; process tree showing execution of whoami; DeviceProcessEvents in MDE capturing the parent-child process relationship

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the host running TeamT5 ThreatSonar Anti-Ransomware and confirm the installed version against the vendor advisory at https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/
  2. Review web server or application logs for the ThreatSonar management interface — look for HTTP POST requests to file upload endpoints with dangerous MIME types or extensions (.php, .asp, .aspx, .jsp, .exe, .ps1)
  3. Enumerate files recently created in ThreatSonar installation directories (default: %ProgramFiles%\TeamT5\ThreatSonar or equivalent) with extensions matching web-executable types
  4. Determine whether any suspicious files were executed after creation by correlating file creation timestamps with process execution events
  5. Check for outbound C2 connections or lateral movement originating from the ThreatSonar service account or web server process

Containment

  1. Immediately block network access to the ThreatSonar management web interface at the firewall level to prevent further exploitation — restrict to known administrator IP ranges only
  2. Isolate the affected host from the network using EDR host isolation capabilities if active exploitation or post-exploitation activity is confirmed
  3. Suspend or disable the ThreatSonar web service until a patched version is applied or a compensating control (WAF rule blocking dangerous file uploads) is in place

Evidence Collection

  1. Collect all files created in ThreatSonar directories within the exploitation window, preserving original timestamps, hashes (MD5/SHA256), and file metadata for forensic analysis
  2. Export web server access logs, IIS logs, or equivalent application logs covering the period of the alert — capture full request URIs, source IPs, user agents, HTTP methods, and response codes
  3. Capture a memory image of the ThreatSonar service process and any spawned child processes if active compromise is suspected, before terminating processes

Escalation Criteria

  • !Escalate to IR team immediately if any uploaded file has been executed — indicated by child processes spawned from the web server or ThreatSonar process after file creation
  • !Escalate if the compromised host is a security management server with visibility into endpoint telemetry, as an attacker may use this position to blind other security controls or move laterally to managed endpoints

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Files with web-executable extensions (.php, .asp, .aspx, .jsp) in ThreatSonar installation directories — hash and submit to threat intelligence platforms
  • >IIS or web server logs showing POST requests to upload endpoints with anomalous Content-Type headers or filenames
  • >Windows Event ID 4688 or Sysmon Event ID 1 showing unexpected child processes spawned by the ThreatSonar service (w3wp.exe, java.exe, or equivalent)
  • >Network connection logs from the ThreatSonar host to external IPs on non-standard ports following file creation events
  • >Windows prefetch files (.pf) or Shimcache entries for any newly created executables in ThreatSonar directories

Tuning Guidance

This detection relies on path-based matching for ThreatSonar directories. If the ThreatSonar installation path is non-default in your environment, update the path patterns accordingly. Reduce false positives by baselining the file types legitimately written to ThreatSonar directories during update windows and excluding known-good update hashes. For higher confidence, add a sequence condition requiring a suspicious process spawn within 10 minutes of the file creation event. If ThreatSonar is running on a dedicated server with no user workload, any outbound connection from ThreatSonar processes to non-TeamT5 IPs should be treated as high-fidelity.

Hunting Queries

Threat hunt for web shell execution patterns — identifies command interpreters launched as children of web server or ThreatSonar processes, which would indicate successful exploitation and post-exploitation activity

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessParentFileName has_any ('w3wp.exe', 'java.exe', 'node.exe', 'python.exe')
| where InitiatingProcessFileName has_any ('ThreatSonar', 'threatsonar', 'antiransomware') or FolderPath has_any ('ThreatSonar', 'threatsonar')
| where FileName in~ ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'python.exe', 'cscript.exe', 'wscript.exe', 'mshta.exe')
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(ParentImage, "(?i)(w3wp|java|node|threatsonar)")
| where match(Image, "(?i)(cmd\.exe|powershell|sh|bash|python|cscript|wscript|mshta)")
| where match(CommandLine, "(?i)(upload|webshell|whoami|net user|wget|curl|certutil)")
| table _time, host, Image, CommandLine, ParentImage, ParentCommandLine, User

Atomic Red Team Tests

Test 1 Simulate web shell upload to ThreatSonar upload directory
windows

Creates a PHP web shell file in a simulated ThreatSonar upload directory to trigger file creation detection rules for CVE-2024-7694

Command

powershell 
New-Item -ItemType Directory -Force -Path 'C:\Program Files\TeamT5\ThreatSonar\uploads' | Out-Null; Set-Content -Path 'C:\Program Files\TeamT5\ThreatSonar\uploads\test_shell.php' -Value '<?php echo shell_exec($_GET["cmd"]); ?>'

Cleanup

powershell 
Remove-Item -Force 'C:\Program Files\TeamT5\ThreatSonar\uploads\test_shell.php' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) showing creation of .php file in ThreatSonar path; DeviceFileEvents in MDE showing FileName=test_shell.php in ThreatSonar directory

Expected Detection

KQL and SPL queries should alert on .php extension file created in ThreatSonar path; Chronicle YARA-L rule should trigger on FILE_CREATION event matching ThreatSonar path pattern

Test 2 Simulate ASP webshell drop via PowerShell (ThreatSonar IIS context)
windows

Creates an ASPX web shell in a simulated ThreatSonar IIS web root directory to validate detection coverage for server-side script execution types

Command

powershell 
New-Item -ItemType Directory -Force -Path 'C:\inetpub\wwwroot\threatsonar' | Out-Null; Set-Content -Path 'C:\inetpub\wwwroot\threatsonar\shell.aspx' -Value '<%@ Page Language="C#" %><% Response.Write(System.Diagnostics.Process.Start(Request["cmd"]).StandardOutput.ReadToEnd()); %>'

Cleanup

powershell 
Remove-Item -Force 'C:\inetpub\wwwroot\threatsonar\shell.aspx' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 with TargetFilename matching *.aspx in wwwroot/threatsonar; IIS log entry if file is subsequently requested

Expected Detection

EQL sequence rule should detect FileCreate with .aspx extension in ThreatSonar-named path; Elastic and Chronicle rules should both fire

Test 3 Simulate post-exploitation cmd.exe spawn from web worker process in ThreatSonar context
windows

Simulates a web shell execution scenario by launching cmd.exe as a child of a renamed process to mimic w3wp.exe spawning a shell after successful file upload exploitation

Command

powershell 
Copy-Item 'C:\Windows\System32\cmd.exe' -Destination 'C:\Temp\threatsonar_worker.exe' -Force; Start-Process 'C:\Temp\threatsonar_worker.exe' -ArgumentList '/c whoami > C:\Temp\threatsonar_exec_output.txt 2>&1' -Wait

Cleanup

powershell 
Remove-Item -Force 'C:\Temp\threatsonar_worker.exe', 'C:\Temp\threatsonar_exec_output.txt' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe spawned from threatsonar_worker.exe process; process tree showing execution of whoami; DeviceProcessEvents in MDE capturing the parent-child process relationship

Expected Detection

Hunting queries for web shell execution patterns should surface this parent-child process relationship; CrowdStrike CQL SyntheticProcessRollup2 events should capture the process creation

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections