Check Point Security Gateway Improper Authentication (CVE-2026-50751)

let timeWindow = 1h;
let suspiciousIKE = CommonSecurityLog
| where TimeGenerated > ago(timeWindow)
| where DeviceVendor == "Check Point"
| where Activity has_any ("IKE", "VPN", "IPSec")
| where Message has_any ("IKEv1", "ikev1", "phase1", "aggressive mode")
| where Message has_any ("auth", "authentication", "identity", "failed", "bypass", "invalid")
| project TimeGenerated, DeviceAction, SourceIP, DestinationIP, Message, Activity, DeviceName;
let authAnomalies = CommonSecurityLog
| where TimeGenerated > ago(timeWindow)
| where DeviceVendor == "Check Point"
| where Activity has "VPN"
| where DeviceAction in ("Accept", "Allow")
| where Message has_any ("unauthenticated", "no credentials", "pre-shared", "certificate")
| project TimeGenerated, SourceIP, DestinationIP, DeviceAction, Message, DeviceName;
union suspiciousIKE, authAnomalies
| summarize EventCount=count(), Messages=make_set(Message, 10), Actions=make_set(DeviceAction) by SourceIP, DeviceName, bin(TimeGenerated, 5m)
| where EventCount > 2
| extend RiskScore = case(EventCount > 20, "High", EventCount > 5, "Medium", "Low")
| order by EventCount desc

index=firewall sourcetype=cp_log OR sourcetype=checkpoint_splunk
| where vendor="Check Point" OR product="Security Gateway"
| where (message LIKE "%IKEv1%" OR message LIKE "%ikev1%" OR message LIKE "%aggressive mode%" OR action LIKE "%IKE%")
| eval auth_anomaly=if(match(message, "(?i)(auth.*fail|bypass|unauthenticated|no.credential|invalid.identity|pre-shared.key.mismatch)"), 1, 0)
| eval ikev1_indicator=if(match(message, "(?i)(ikev1|ike.version.1|phase.1.aggressive)"), 1, 0)
| where auth_anomaly=1 OR ikev1_indicator=1
| stats count AS event_count, values(message) AS messages, values(action) AS actions, dc(src_ip) AS unique_sources BY src_ip, host, _time span=5m
| where event_count > 2
| eval risk=case(event_count > 20, "HIGH", event_count > 5, "MEDIUM", true(), "LOW")
| eval cve="CVE-2026-50751"
| table _time, src_ip, host, event_count, risk, messages, cve
| sort - event_count

sequence by source.ip with maxspan=10m
  [network where event.dataset == "checkpoint.firewall"
   and (message like~ "*IKEv1*" or message like~ "*aggressive mode*" or message like~ "*ikev1*")
   and destination.port in (500, 4500)]
  [network where event.dataset == "checkpoint.firewall"
   and (event.action like~ "*auth*" or message like~ "*authentication*" or message like~ "*bypass*")
   and (event.outcome == "failure" or message like~ "*failed*" or message like~ "*unauthenticated*")]

SELECT sourceip, destinationip, devicename, QIDNAME(qid) AS event_name, UTF8(payload) AS raw_payload, starttime, eventcount
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%Check Point%'
  AND (
    UTF8(payload) ILIKE '%IKEv1%'
    OR UTF8(payload) ILIKE '%aggressive mode%'
    OR UTF8(payload) ILIKE '%ikev1%'
    OR (UTF8(payload) ILIKE '%authentication%' AND UTF8(payload) ILIKE '%fail%')
    OR UTF8(payload) ILIKE '%bypass%'
  )
  AND destinationport IN (500, 4500)
GROUP BY sourceip, devicename, EXTRACT(EPOCH FROM starttime) / 300
HAVING COUNT(*) > 2
ORDER BY eventcount DESC
LAST 1 HOURS

_sourceCategory=firewall/checkpoint OR _sourceCategory=network/vpn
| where vendor = "Check Point" or _sourceName matches "*checkpoint*"
| where message matches "*IKEv1*" or message matches "*aggressive mode*" or message matches "*ikev1*"
   or (message matches "*authentication*" and (message matches "*fail*" or message matches "*bypass*" or message matches "*unauthenticated*"))
| where _sourcePort = 500 or _sourcePort = 4500 or dest_port = 500 or dest_port = 4500
| timeslice 5m
| count by src_ip, _sourceHost, _timeslice
| where _count > 2
| sort by _count desc

rule checkpoint_cve_2026_50751_ikev1_auth_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-50751 exploitation: improper authentication via deprecated IKEv1 on Check Point Security Gateway"
    severity = "CRITICAL"
    confidence = "MEDIUM"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"
    cve = "CVE-2026-50751"

  events:
    $e.metadata.vendor_name = "Check Point"
    $e.metadata.product_name = /Security Gateway/i
    (
      $e.principal.port = 500 or
      $e.principal.port = 4500 or
      $e.target.port = 500 or
      $e.target.port = 4500
    )
    (
      $e.metadata.description = /IKEv1/i or
      $e.metadata.description = /aggressive mode/i or
      (
        $e.metadata.description = /auth/i and
        $e.metadata.description = /(fail|bypass|unauthenticated)/i
      )
    )

  match:
    $e.principal.ip over 5m

  outcome:
    $risk_score = max(
      if($e.metadata.description = /bypass/i, 90,
      if($e.metadata.description = /unauthenticated/i, 85, 70))
    )

  condition:
    #e > 2
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6
| DestinationPort in (500, 4500)
| RemoteAddressIP4=* OR RemoteAddressIP6=*
| join(event_simpleName=ProcessRollup2, field=[TargetProcessId, aid], include=[FileName, CommandLine])
  {
    FileName in ("fwk.elg", "vpnd", "ike", "iked")
    OR CommandLine matches /ikev1|IKEv1|aggressive.mode/i
  }
| groupby([RemoteAddressIP4, ComputerName, FileName], function=[count(as=event_count), collect(CommandLine)])
| event_count > 2
| sort(event_count, order=desc)