Motex LANSCOPE Endpoint Manager - Improper Verification of Communication Channel Source (CVE-2025-61932)

let lanscope_ports = dynamic(["8080", "8443", "443", "80"]);
let known_mgmt_servers = dynamic([]);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName has_any ("lanscope", "lsepagent", "lsep", "epagent")
| where RemotePort in (lanscope_ports)
| where isnotempty(RemoteIP)
| extend IsTrustedServer = RemoteIP in (known_mgmt_servers)
| where IsTrustedServer == false
| summarize ConnectionCount=count(), RemoteIPs=make_set(RemoteIP), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
| where ConnectionCount > 0
| extend AlertTitle = "LANSCOPE Agent Communicating with Unrecognized Management Server"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteIPs, Ports, ConnectionCount, AlertTitle

index=endpoint OR index=network sourcetype IN ("WinEventLog:Security", "xmlwineventlog", "sysmon", "crowdstrike:events:sensor")
| eval process_lower=lower(process_name)
| where like(process_lower, "%lanscope%") OR like(process_lower, "%lsepagent%") OR like(process_lower, "%epagent%") OR like(process_lower, "%lsep%")
| eval dest_port=coalesce(dest_port, DestinationPort)
| eval dest_ip=coalesce(dest_ip, DestinationIp, dest)
| where dest_port IN ("80", "443", "8080", "8443")
| stats count as connection_count, values(dest_ip) as dest_ips, values(dest_port) as dest_ports, dc(dest_ip) as unique_dest_ips by host, process_name, user, _time
| where unique_dest_ips > 0
| eval risk_score=case(unique_dest_ips > 5, "high", unique_dest_ips > 2, "medium", true(), "low")
| table _time, host, user, process_name, dest_ips, dest_ports, connection_count, unique_dest_ips, risk_score
| sort -connection_count

sequence by host.name, process.name with maxspan=5m
  [network where process.name like~ "*lanscope*" or process.name like~ "*lsepagent*" or process.name like~ "*epagent*"
   and destination.port in (80, 443, 8080, 8443)
   and not destination.ip like "10.*" and not destination.ip like "192.168.*" and not destination.ip like "172.16.*"]
  [network where process.name like~ "*lanscope*" or process.name like~ "*lsepagent*" or process.name like~ "*epagent*"
   and destination.port in (80, 443, 8080, 8443)]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') as EventTime, sourceip, destinationip, destinationport, username, "Application" as app_name, "EventID" as event_id, CATEGORYNAME(category) as category_name, logsourcename(logsourceid) as log_source
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon', 'CrowdStrike Falcon')
AND (LOWER("Application") LIKE '%lanscope%' OR LOWER("Application") LIKE '%lsepagent%' OR LOWER("Application") LIKE '%epagent%')
AND destinationport IN (80, 443, 8080, 8443)
AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=endpoint OR _sourceCategory=windows/sysmon
| where (toLowerCase(%"process_name") matches "*lanscope*" or toLowerCase(%"process_name") matches "*lsepagent*" or toLowerCase(%"process_name") matches "*epagent*")
| where %"dest_port" in ("80", "443", "8080", "8443")
| timeslice 1h
| count as connection_count, values(%"dest_ip") as destination_ips by _timeslice, %"host", %"user", %"process_name"
| where connection_count > 0
| fields _timeslice, %"host", %"user", %"process_name", destination_ips, connection_count
| sort by connection_count desc

rule cve_2025_61932_lanscope_suspicious_comms {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects LANSCOPE Endpoint Manager agent communicating with potentially unauthorized management channels - CVE-2025-61932"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-61932"

  events:
    $network.metadata.event_type = "NETWORK_CONNECTION"
    (
      re.regex($network.principal.process.file.full_path, `(?i)(lanscope|lsepagent|epagent|lsep)`) or
      re.regex($network.principal.process.file.names, `(?i)(lanscope|lsepagent|epagent)`)
    )
    $network.target.port in (80, 443, 8080, 8443)
    $network.principal.hostname = $hostname
    $network.target.ip = $dest_ip

  match:
    $hostname, $dest_ip over 1h

  outcome:
    $risk_score = max(65)
    $process_path = array_distinct($network.principal.process.file.full_path)
    $dest_ports = array_distinct($network.target.port)

  condition:
    #network >= 3
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=DnsRequest
| ImageFileName=/lanscope|lsepagent|epagent|lsep/i
| RemotePort in (80, 443, 8080, 8443)
| stats count() as connection_count, array_agg(RemoteAddressIP4) as remote_ips, array_agg(RemotePort) as remote_ports by aid, ComputerName, ImageFileName, UserName
| where connection_count > 0
| sort connection_count desc
| limit 500