SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24

rule SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 : SCRIPT
{
	meta:
		description = "Detects post exploitation indicators observed by HuntressLabs in relation to the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
		author = "Florian Roth"
		id = "079f4153-8bc7-574f-b6fa-af5536b842ab"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L62-L103"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "6f0d5f878847da1afb0d7b83e84bd337cfa67c36da2cbb33af712ed4ffad490a"
		score = 75
		quality = 83
		tags = "SCRIPT"

	strings:
		$x01 = "-c foreach ($disk in Get-WmiObject Win32_Logicaldisk){Add-MpPreference -ExclusionPath $disk.deviceid}"
		$x02 = ".msi c:\\mpyutd.msi"
		$x03 = "/MyUserName_$env:UserName"
		$x04 = " -OutFile C:\\Windows\\Help\\"
		$x05 = "/Create /TN \\\\Microsoft\\\\Windows\\\\Wininet\\\\UserCache_"
		$x06 = "$e = $r + \"ssh.exe\""
		$x07 = "Start-Process -f $e -a $args -PassThru -WindowStyle Hidden).Id"
		$x08 = "-R 9595:localhost:3389 -p 443 -N -oStrictHostKeyChecking=no "
		$x09 = "chromeremotedesktophost.msi', $env:ProgramData+"
		$x10 = "9595; iwr -UseBasicParsing "
		$x11 = "curl  https://cmctt.]com/pub/media/wysiwyg/"
		$x12 = ":8080/servicetest2.dll"
		$x13 = "/msappdata.msi c:\\mpyutd.msi"
		$x14 = "/svchost.exe -OutFile "
		$x15 = "curl http://minish.wiki.gd"
		$x16 = " -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile "
		$x17 = "rundll32.exe' -Headers @"
		$x18 = "/nssm.exe' -Headers @"
		$x19 = "c:\\programdata\\update.dat UpdateSystem"
		$x20 = "::size -eq 4){\\\"TVqQAA" ascii wide
		$x21 = "::size -eq 4){\"TVqQAA" ascii wide
		$x22 = "-nop -c [System.Reflection.Assembly]::Load(([WmiClass]'root\\cimv2:System_"
		$xp0 = "/add default test@2021! /domain"
		$xp1 = "/add default1 test@2021! /domain"
		$xp2 = "oldadmin Pass8080!!"
		$xp3 = "temp 123123qwE /add "
		$xp4 = "oldadmin \"Pass8080!!\""
		$xp5 = "nssm set xmrig AppDirectory "

	condition:
		1 of ( $x* )
}