Detection: Nginx ConnectWise ScreenConnect Authentication Bypass

Updated Date: 2024-09-30 ID: b3f7a803-e802-448b-8eb2-e796b223bccc Author: Michael Haag, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via alternate paths or channels. It leverages Nginx access logs to identify web requests to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected ScreenConnect instance, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.

1`nginx_access_logs` uri_path IN ("*/SetupWizard.aspx/*","*/SetupWizard/") status=200 http_method=POST  
2| stats count min(_time) as firstTime max(_time) as lastTime by src, dest, http_user_agent, url, uri_path, status, http_method, sourcetype, source 
3| `security_content_ctime(firstTime)` 
4| `security_content_ctime(lastTime)` 
5| `nginx_connectwise_screenconnect_authentication_bypass_filter`

Data Source

Name Platform Sourcetype Source
Nginx Access N/A 'nginx:plus:kv' '/var/log/nginx/access.log'

Macros Used

Name Value
nginx_access_logs (sourcetype="nginx:plus:kv" OR sourcetype="nginx:plus:access")
nginx_connectwise_screenconnect_authentication_bypass_filter search *
nginx_connectwise_screenconnect_authentication_bypass_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1190 Exploit Public-Facing Application Initial Access
KillChainPhase.DELIVERY
NistCategory.DE_CM
Cis18Value.CIS_13
APT28
APT29
APT39
APT41
APT5
Agrius
Axiom
BackdoorDiplomacy
BlackTech
Blue Mockingbird
Cinnamon Tempest
Dragonfly
Earth Lusca
Ember Bear
FIN13
FIN7
Fox Kitten
GALLIUM
GOLD SOUTHFIELD
HAFNIUM
INC Ransom
Ke3chang
Kimsuky
Magic Hound
Moses Staff
MuddyWater
Play
Rocke
Sandworm Team
Threat Group-3390
ToddyCat
Volatile Cedar
Volt Typhoon
Winter Vivern
menuPass

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

To implement this analytic, ensure proper logging is occurring with Nginx, access.log and error.log, and that these logs are being ingested into Splunk. STRT utilizes this nginx.conf https://gist.github.com/MHaggis/26f59108b04da8f1d870c9cc3a3c8eec to properly log as much data with Nginx.

Known False Positives

False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
An authentication bypass attempt against ScreenConnect has been detected on $dest$. 100 100 100
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset nginx:plus:kv nginx:plus:kv
Integration ✅ Passing Dataset nginx:plus:kv nginx:plus:kv

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3