# CVE-2024-1709 IOCs - ConnectWise ScreenConnect Auth Bypass

## HTTP Request Patterns
GET /SetupWizard.aspx
POST /SetupWizard.aspx
GET /SetupWizard.aspx?step=1
/App_Extensions/*.ashx (post-exploitation extension upload)

## ScreenConnect Log Patterns
Unauthorized admin account creation
Session creation without corresponding auth event
Extension uploads from unexpected IPs

## Post-Exploitation Artifacts (LockBit Campaign)
C:\ProgramData\ScreenConnect\App_Extensions\*.dll
C:\Windows\Temp\asyncrat.exe
PowerShell download cradles in ScreenConnect service logs

## Detection Queries
# IIS logs
findstr /i "SetupWizard.aspx" C:\inetpub\logs\LogFiles\*\*.log

# ScreenConnect application logs
Select-String -Path "C:\Program Files (x86)\ScreenConnect\Logs\*.txt" -Pattern "SetupWizard|Unauthorized"

# Splunk
index=web sourcetype=iis cs_uri_stem="/SetupWizard.aspx" | stats count by c_ip

## Behavioral Indicators
ScreenConnect service spawning unexpected child processes
Outbound connections from ScreenConnect to non-update domains
New admin users created without corresponding help desk tickets
Mass file downloads from managed endpoints
