Skip to content

Instantly share code, notes, and snippets.

@JohnHammond

JohnHammond/SetupWizard_IIS_log.yara Secret

Last active February 22, 2024 19:37
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JohnHammond/e07caff1b2d4526b7fabbecd63784258 to your computer and use it in GitHub Desktop.
Save JohnHammond/e07caff1b2d4526b7fabbecd63784258 to your computer and use it in GitHub Desktop.
Download ZIP
SetupWizard_IIS_log.yara
Raw
SetupWizard_IIS_log.yara
rule ScreenConnect_CVE_2024_1709_Exploitation {
meta:
description = "Detects a GET request to '/SetupWizard.aspx/' with anything following it, which is a potential indicator of compromise of the 2024 ConnectWise ScreenConnect 23.9.8 vulnerability (CWE-288), when found in IIS logs"
author = "Huntress DE&TH Team"
reference = "https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass"
date = "2024-02-20"
id = "2886530b-e164-4c4b-b01e-950e3c40acb4"
strings:
$s1 = "/SetupWizard.aspx/" ascii
condition:
$s1
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment