Detection rules › Splunk
Temporary ConnectWise xml File Activity (Windows Event Log)
ConnectWise ScreenConnect is a popular remote desktop solution. ConnectWise released an advisory detailing a critical authentication bypass vulnerability affecting ScreenConnect versions prior to 23.9.8. This use case detects when an XML file in the \Temp\ScreenConnect[version number]\ directory has been created, modified, or deleted. To enable detection of the file activities associated with the vulnerability, configure the Advanced Auditing policy to log successful Windows Event ID 4663 events, and set a System Access Control List (SACL) on the target directory to monitor file modifications. See Huntress article in references for detailed information.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Command & Control |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4663: An attempt was made to access an object. |
Rule body
id: '28096.51137'
title: Temporary ConnectWise xml File Activity
description: ConnectWise ScreenConnect is a popular remote desktop solution. ConnectWise
released an advisory detailing a critical authentication bypass vulnerability affecting
ScreenConnect versions prior to 23.9.8. This use case detects when an XML file in
the \Temp\ScreenConnect\[version number]\ directory has been created, modified,
or deleted. To enable detection of the file activities associated with the vulnerability,
configure the Advanced Auditing policy to log successful Windows Event ID 4663 events,
and set a System Access Control List (SACL) on the target directory to monitor file
modifications. See Huntress article in references for detailed information.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
"<EventID>4663<") "C:\\Windows\\Temp\\ScreenConnect\\" ".xml" | regex ObjectName="(?i)C:\x5cWindows\x5cTemp\x5c\ScreenConnect\x5c.+\.xml"
| table _time, host, user, process, process_*, ObjectName | bin span=1s | stats
values(*) as * by _time, host '
techniques:
- persistence:external remote services
- command-and-control:remote access software
- initial-access:external remote services
technique_id:
- T1133
- T1219
data_category:
- File monitoring
- Windows event logs
references:
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR "<EventID>4663<") "C:\\Windows\\Temp\\ScreenConnect\\" ".xml"
Stage 2: regex
| regex ObjectName="(?i)C:\x5cWindows\x5cTemp\x5c\ScreenConnect\x5c.+\.xml"
Stage 3: table
| table _time, host, user, process, process_*, ObjectName
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4663" |
ObjectName | regex_match |
| field:"ObjectName" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4663<" |
| 1 | "C:\\Windows\\Temp\\ScreenConnect\\" |
| 1 | ".xml" |