Webserver Detection of ScreenConnect SetupWizard Authentication Bypass Exploitation (CVE-2024-1709)

title: Webserver Detection of ScreenConnect SetupWizard Authentication Bypass Exploitation (CVE-2024-1709)
id: 8b92216f-e083-4e46-b220-a44b837e8472
status: test
description: This rule flags web requests whose URI stem contains '/SetupWizard.aspx/' as indicators consistent with exploitation attempts targeting ScreenConnect authentication bypass behavior. Attackers can use this type of request path to reach setup or authentication-related endpoints during compromise. The detection relies on webserver telemetry that records the requested URI stem for GET requests.
references:
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
  - https://www.cve.org/CVERecord?id=CVE-2024-1709
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/web_exploit_cve_2024_1709_screenconnect.yml
author: Matt Anderson, Huntress, Huntrule Team
date: 2024-02-20
tags:
  - attack.initial-access
  - attack.persistence
  - cve.2024-1709
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /SetupWizard.aspx/
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: d27eabad-9068-401a-b0d6-9eac744d6e67
    type: derived