CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security
This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Definition
Requirements: SACLs must be enabled for the ScreenConnect directory
detection:
selection:
EventID: 4663
ObjectType: 'File'
ProcessName|contains: 'ScreenConnect.Service.exe'
AccessMask: '0x6'
ObjectName|endswith:
- 'ScreenConnect\\App_Extensions\\*.ashx'
- 'ScreenConnect\\App_Extensions\\*.aspx'
filter_main_legit_extension:
ObjectName|contains: 'ScreenConnect\App_Extensions\\*\\'
condition: selection and not 1 of filter_main_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Other