CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation

Description

Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.

Query · sigma

selection:
  cs-uri-stem|contains: /SetupWizard.aspx/
condition: selection

Known false positives

  • Unknown
Raw source CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation
id: d27eabad-9068-401a-b0d6-9eac744d6e67
status: test
description: |
    Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.
references:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
    - https://www.cve.org/CVERecord?id=CVE-2024-1709
author: Matt Anderson, Huntress
date: 2024-02-20
tags:
    - attack.initial-access
    - attack.persistence
    - cve.2024-1709
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|contains: '/SetupWizard.aspx/'
    condition: selection
falsepositives:
    - Unknown
level: critical

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.