Huntress Shares Detection Guidance for ConnectWise ScreenConnect Authentication Bypass

Summary

Huntress describes artifacts and Windows auditing that may help investigate exploitation of ConnectWise ScreenConnect’s CVE-2024-1709 authentication bypass, while warning that the available evidence may not definitively establish exploitation.

Key points

Huntress says it reproduced and weaponized the CWE-288 authentication bypass using an alternate path of channel, and recommends updating ScreenConnect to version 23.9.8.
The ScreenConnect User.xml file may show a newly created account, but normal user activity overwrites the file, complicating definitive identification of exploitation.
A temporary XML file under C:\Windows\Temp\ScreenConnect may be removed quickly but could be recoverable through disk forensics.
Huntress recommends configuring Advanced Auditing and a SACL to log successful Windows Event ID 4663 events for modifications to the relevant directory; events can be forwarded to a SIEM.
Huntress also observed evidence in IIS logs but withheld details, saying disclosure could alert attackers.
The described artifacts may support threat hunting and incident triage, but Huntress cautions they may not alone prove exploitation.

Article Details

Defense Focus: Detect and investigate potential exploitation of ConnectWise ScreenConnect CVE-2024-1709 using file-system, account, and IIS-log artifacts; patch affected software.
Detection Methods: Review User.xml for accounts created outside normal procedures; interpret its timestamps cautiously because the file is overwritten after successful user activity.
Use disk forensics to recover transient GUID-named XML files from the ScreenConnect temporary directory.
Monitor successful Windows Event ID 4663 events for modifications to the relevant directory.
Review IIS logs for evidence of exploit execution; the article does not disclose specific log-entry contents.
Data Sources: ScreenConnect User.xml at C:\Program Files (x86)\ScreenConnect\App_Data\
Windows Security Event ID 4663
File-system artifacts in C:\Windows\Temp\ScreenConnect\23.9.7.8804\
IIS logs
Process Monitor observations
Platforms: ScreenConnect
Windows
IIS
SIEM
Defensive Actions: Immediately update ConnectWise software to version 23.9.8, as recommended by Huntress.
Configure Advanced Auditing to log successful Windows Event ID 4663 events and set a SACL on the relevant directory.
Forward the resulting events to a SIEM.
Review account records and available file-system and IIS artifacts during threat hunting and incident investigation; do not treat the artifacts alone as definitive proof of exploitation.