Identifying Endpoints Vulnerable to CVE-2024-1708 & CVE-2024-1709

ConnectWise has also reported several breaches of ScreenConnect accounts due to vulnerabilities CVE-2024-1708 and CVE-2024-1709. According to ShadowServer, approximately 93% of ScreenConnect servers remain vulnerable, and these security gaps have already been leveraged in ransomware attacks.
Given the escalating threat posed by these vulnerabilities, Action1 has developed two scripts to assist in scanning systems for possible remote-control software as well as indicators of compromise specifically related to this vulnerability as reported by BitDefender. These scripts were designed to be used in Action1 (instructions below) but can be used stand alone or with any endpoint management/RMM system.

How to identify unauthorized remote-control tools on your network

Remote control software is indispensable for productivity and remote support but can introduce vulnerabilities if not managed correctly. Likewise threat actors will often use commercially available tools to maintain control of compromised systems. Due to these being legitimate software products, they can often slide under the radar of your typical threat hunting tools. To assist IT administrators in safeguarding their networks, Action1 has developed a PowerShell script to assist with finding these tools for further scrutiny. This script is designed to provide comprehensive insights into the presence of common remote access applications, such as AnyDesk, ConnectWise, TeamViewer, Splashtop, among others, across networks. It can identify up to *147 known remote-control applications, reporting their versions for enhanced monitoring. This functionality enables detailed reporting, filtering, and alerting, specifically if the ScreenConnect agent, or any other agent, is outdated, potentially vulnerable, or unrecognized as legitimate. By utilizing this script, IT professionals can take a proactive stance in maintaining network security and ensuring the integrity of their own remote access tools.

The script to detect remote control software can be downloaded using the provided link or direct from our GitHub repository.

Copy

View on GitHub

* Note: If you use the remote-control agent search script outside of Action1, by default the Action1 agent is excluded, but this is an easy edit to make the script detect it as well, just remove action1_agent.exe from the $ignore array variable.

How to Scan Systems for Indicators of ScreenConnect Compromise

This script developed by Action1, is designed to alert administrators to potential unauthorized access and malicious use of their hosts. BitDefender reported that systems that had been compromised using CVE-2024-1708 and CVE-2024-1709, would leave behind malicious files in the ScreenConnect extension directory to maintain persistence. The following script monitors that directory for signs of change. Note there may or may not be files already present in this directory for your implementation, this script is designed to keep record of what those files are and when last modified, so you can set up alerts detecting unexpected or unauthorized edits, creations, or deletions from this directory. Also note this script does not detect any malicious code indicators outright, so presence of files here should be investigated for legitimacy, and absence of files here only indicates this host was not compromised in this commonly reported way.
The script to detect CVE-2024-1708 & CVE-2024-1709 IOC can be downloaded using the provided link, or direct from our GitHub repository.

Copy

View on GitHub

Using these scripts in Action1

Log in to the Action1 Platform or sign up for an account, the first 100 endpoints are free with no feature limitations.

Then follow the instructions below for adding new data sources and reports to the system.

1. Click to create a new data source or follow these steps:

• • Go to Configuration | Data Sources, click [+New]
  • Enter data source name, such as ‘Remote Control Tools’, [Next]
  • Copy and paste the script above, [Next]
  • Run on a test endpoint*, [Finish]

  *This step WILL run the script on the endpoint, so ensure whatever system is being tested on has a proper backup recovery procedure.

2. Click to create a new report based on the new data source or:

• • Go to Real-time Reports & Alerts | Custom Reports, click +Add
  • Select your new data source (e.g. ‘Remote Control Tools’)
  • Enter report name, such as ‘Remote Control Tools’, [Next].
  • Choose [Simple Report]
  • Click [Add Columns] and add all columns, [Next], [Finish]

For more insights and updates, keep an eye on our blog and join our upcoming webinars.