Skip to content

Instantly share code, notes, and snippets.

@JohnHammond

JohnHammond/SetupWizard_sigma_rule.yml Secret

Last active February 22, 2024 19:36
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JohnHammond/65cee24bc949be53e6744a84e78b7239 to your computer and use it in GitHub Desktop.
Save JohnHammond/65cee24bc949be53e6744a84e78b7239 to your computer and use it in GitHub Desktop.
Download ZIP
SetupWizard_sigma_rule.yml
Raw
SetupWizard_sigma_rule.yml
title: CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation
id: d27eabad-9068-401a-b0d6-9eac744d6e67
status: experimental
description: |
Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.
references:
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.cve.org/CVERecord?id=CVE-2024-1709
author: Matt Anderson, Huntress
date: 2024/02/20
tags:
- attack.initial_access
- attack.persistence
- cve.2024.1709
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: '/SetupWizard.aspx/'
condition: selection
falsepositives:
- Unknown
level: critical
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment