SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exploitation_IIS_Logs

rule SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exploitation_IIS_Logs
{
	meta:
		description = "Detects an http request to '/SetupWizard.aspx/' with anything following it, which when found in IIS logs is a potential indicator of compromise of the 2024 ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
		author = "Huntress DE&TH Team (modified by Florian Roth)"
		id = "2886530b-e164-4c4b-b01e-950e3c40acb4"
		date = "2024-02-20"
		modified = "2024-02-21"
		reference = "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L3-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "f6c7a3aa2ed98e754f9523c55eb035c7bc5f8aea96a6f86c729e9658d78710fb"
		score = 75
		quality = 85
		tags = ""

	strings:
		$s1 = " GET /SetupWizard.aspx/" ascii
		$s2 = " POST /SetupWizard.aspx/" ascii
		$s3 = " PUT /SetupWizard.aspx/" ascii
		$s4 = " HEAD /SetupWizard.aspx/" ascii

	condition:
		1 of them
}