Webserver Path Scan for ScreenConnect SetupWizard Authentication Bypass (CVE-2024-1709)
Alerts on web requests to '/SetupWizard.aspx/' that match exploitation patterns for ScreenConnect authentication bypass CVE-2024-1709.
FreeReviewedSigma · Critical · v5
- Category
- webserver
- Author
- Matt Anderson, Huntress (SigmaHQ), DRL 1.1
- Published
- 2024-02-20
- Updated
- 2026-07-31
What it detects
This rule matches webserver GET requests whose URI stem contains '/SetupWizard.aspx/' with any following path segment. That pattern is used to probe or trigger ScreenConnect authentication bypass exploitation associated with CVE-2024-1709. It relies on webserver request telemetry, specifically the requested URI stem, to flag suspicious request paths that target the SetupWizard endpoint.
Reporting behind it
- connectwise.comhttps://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- huntress.comhttps://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- cve.orghttps://www.cve.org/CVERecord?id=CVE-2024-1709
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/web_exploit_cve_2024_1709_screenconnect.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
webserver-detection-of-screenconnect-setupwizard-authentication-bypass-exploitat-d27eabad
title: Webserver Path Scan for ScreenConnect SetupWizard Authentication Bypass (CVE-2024-1709)
id: 8b92216f-e083-4e46-b220-a44b837e8472
status: test
description: This rule matches webserver GET requests whose URI stem contains '/SetupWizard.aspx/' with any following path segment. That pattern is used to probe or trigger ScreenConnect authentication bypass exploitation associated with CVE-2024-1709. It relies on webserver request telemetry, specifically the requested URI stem, to flag suspicious request paths that target the SetupWizard endpoint.
references:
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.cve.org/CVERecord?id=CVE-2024-1709
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/web_exploit_cve_2024_1709_screenconnect.yml
author: Matt Anderson, Huntress, Huntrule Team
date: 2024-02-20
tags:
- attack.initial-access
- attack.persistence
- cve.2024-1709
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /SetupWizard.aspx/
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: d27eabad-9068-401a-b0d6-9eac744d6e67
type: derived