cyber.hendryadrian.com
Detection & Defense · huntress.com

How to Check for ScreenConnect Compromise and Respond

· Original article ↗

Summary

Huntress outlines indicators of possible ScreenConnect compromise, affected on-premises hosts, and response steps. It urges users to isolate affected servers, reset exposed credentials, and patch to version 23.9.8 or newer.

Key points

  • Check for unexpected login failures, suspicious ScreenConnect audit-log activity, zeroed timestamps, rogue .ashx extensions, and SetupWizard.aspx/ activity associated with Windows Event ID 4663.
  • The vulnerability affects on-premises ScreenConnect Server instances; server components may also run on workstations. ConnectWise automatically patched cloud versions, though compromised servers could expose other hosts.
  • Huntress recommends isolating compromised servers, stopping ScreenConnect services, resetting potentially exposed credentials, and patching to version 23.9.8 or newer.
  • Remove ScreenConnect server components from machines where they are not needed; the presence of extension subdirectories alone does not prove compromise.
  • Huntress says its mitigation vaccine is not a long-term solution and still recommends applying the patch.

Article Details

Defense Focus
Detect and respond to potential compromise of on-premises ConnectWise ScreenConnect instances affected by CVE-2024-1708 and CVE-2024-1709.
Detection Methods
  • Review the ScreenConnect Audit Log for suspicious or unexpected activity.
  • Inspect the ScreenConnect App_Data directory for zeroed-out timestamps (0001-01-01T00:00:00), which may indicate a newly created user.
  • Inspect .ashx files in GUID-named subdirectories under App_Extensions for rogue or malicious functionality; the presence of subdirectories alone is not evidence of compromise.
  • Look for SetupWizard.aspx/ activity and correlate it with Windows Event ID 4663.
Data Sources
  • ScreenConnect Audit Log
  • ScreenConnect App_Data files and timestamps
  • ScreenConnect App_Extensions .ashx files
  • Windows Event Viewer, including Event ID 4663
Platforms
  • Windows
Defensive Actions
  • Immediately patch ScreenConnect to version 23.9.8 or newer.
  • Isolate compromised servers.
  • Stop or disable the ScreenConnect Web Server, Session Manager, Security Manager, and Relay services to terminate ScreenConnect sessions.
  • Reset credentials the threat actor may have accessed, including shared passwords on other accounts.
  • Remove ScreenConnect server components from machines where they are not needed.
  • Deploy Huntress for monitoring and begin incident response; do not treat the mitigation vaccine as a long-term substitute for patching.

MITRE ATT&CK

T1136.001 · Local AccountA zeroed-out timestamp in ScreenConnect App_Data may indicate that a new user was created.T1505.003 · Web ShellThe article says threat actors stage an .ashx file in a ScreenConnect extension directory that might allow remote code execution.

CVE

CVE-2024-1708You’ve probably seen it by now, but there was a major ConnectWise ScreenConnect vulnerability (CVE-2024-1708 and CVE-2024-1709) – which we’re calling “SlashAndGrab” – that’s been shared across the cybersecurityCVE-2024-1709seen it by now, but there was a major ConnectWise ScreenConnect vulnerability (CVE-2024-1708 and CVE-2024-1709) – which we’re calling “SlashAndGrab” – that’s been shared across the cybersecurity community. Here’s

Vendors

ConnectWiseYou’ve probably seen it by now, but there was a major ConnectWise ScreenConnect vulnerability (CVE-2024-1708 and CVE-2024-1709) – which we’re calling “SlashAndGrab” – that’s been shared across the cybersecurityHuntressTeam Huntress

Products

ScreenConnectHomeBlogThink Your ScreenConnect Server Is Hacked?

Related Articles