ScreenConnect User Database Modification - Security

Status: test
Severity: medium
Log source: product windows, service security
Author: Matt Anderson, Kris Luzadre, Andrew Schwartz, Huntress
Source: github.com/SigmaHQ/sigma

This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

Known false positives

This will occur legitimately as well and will result in some benign activity.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	No specific technique

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4663: An attempt was made to access an object.

Rule body

title: ScreenConnect User Database Modification - Security
id: 4109cb6a-a4af-438a-9f0c-056abba41c6f
related:
    - id: 1a821580-588b-4323-9422-660f7e131020
      type: similar
status: test
description: |
    This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server.
    This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.
    This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.
references:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.cve.org/CVERecord?id=CVE-2024-1709
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
author: Matt Anderson, Kris Luzadre, Andrew Schwartz, Huntress
date: 2024-02-20
tags:
    - cve.2024-1709
    - detection.emerging-threats
    - attack.defense-impairment
logsource:
    product: windows
    service: security
    definition: 'Requirements: SACLs must be enabled for the ScreenConnect directory'
detection:
    selection:
        EventID: 4663
        ObjectType: 'File'
        AccessMask: '0x6'
        ObjectName|endswith: '.xml'
        ObjectName|contains|all:
            - 'Temp'
            - 'ScreenConnect'
        ProcessName|contains: 'ScreenConnect.Service.exe'
    condition: selection
falsepositives:
    - This will occur legitimately as well and will result in some benign activity.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4663
    ObjectType: 'File'
    AccessMask: '0x6'
    ObjectName|endswith: '.xml'
    ObjectName|contains|all:
        - 'Temp'
        - 'ScreenConnect'
    ProcessName|contains: 'ScreenConnect.Service.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessMask`	eq	`0x6` corpus 3 (sigma 2, kusto 1)	`field:"AccessMask" kind:eq value:"0x6"`
`ObjectName`	ends_with	`.xml`	`field:"ObjectName" kind:ends_with value:".xml"`
`ObjectName`	match	`ScreenConnect` `Temp`	`field:"ObjectName" kind:match`
`ObjectType`	eq	`File` corpus 10 (sigma 8, splunk 2)	`field:"ObjectType" kind:eq value:"File"`
`ProcessName`	match	`ScreenConnect.Service.exe` corpus 2 (sigma 2)	`field:"process_name" kind:match value:"ScreenConnect.Service.exe"`