Detect Check Point Security Gateway Improper Authentication (CVE-2026-50751) in Google Chronicle

rule checkpoint_cve_2026_50751_ikev1_auth_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-50751 exploitation: improper authentication via deprecated IKEv1 on Check Point Security Gateway"
    severity = "CRITICAL"
    confidence = "MEDIUM"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"
    cve = "CVE-2026-50751"

  events:
    $e.metadata.vendor_name = "Check Point"
    $e.metadata.product_name = /Security Gateway/i
    (
      $e.principal.port = 500 or
      $e.principal.port = 4500 or
      $e.target.port = 500 or
      $e.target.port = 4500
    )
    (
      $e.metadata.description = /IKEv1/i or
      $e.metadata.description = /aggressive mode/i or
      (
        $e.metadata.description = /auth/i and
        $e.metadata.description = /(fail|bypass|unauthenticated)/i
      )
    )

  match:
    $e.principal.ip over 5m

  outcome:
    $risk_score = max(
      if($e.metadata.description = /bypass/i, 90,
      if($e.metadata.description = /unauthenticated/i, 85, 70))
    )

  condition:
    #e > 2
}