Full Report
Huntress Guide: Review this guide on how to tell which ScreenConnect Server autoruns are found on your endpoint so you can quickly find and remove them.
Analysis Summary
# Best Practices: ScreenConnect "SlashAndGrab" Vulnerability Mitigation (CVE-2024-1708 & CVE-2024-1709)
## Overview
These practices address critical vulnerabilities in ConnectWise ScreenConnect (formerly ScreenConnect Control) that allow for authentication bypass and remote code execution. Because these flaws are actively exploited, the focus is on rapid remediation, threat hunting for indicators of compromise (IOCs), and minimizing the attack surface by removing unnecessary server components from endpoints.
## Key Recommendations
### Immediate Actions
1. **Patch Immediately:** Upgrade all on-premises ScreenConnect instances to **version 23.9.8 or newer**. ConnectWise has removed license restrictions for this update.
2. **Assume Compromise:** Conduct a retroactive hunt for IOCs on all servers, even those recently patched.
3. **Audit User Files:** Check `C:\Program Files (x86)\ScreenConnect\App_Data\User.xml` for modifications or zeroed-out timestamps (`0001-01-01T00:00:00`), which indicate unauthorized user creation.
4. **Isolate Affected Hosts:** If compromise is suspected, use network isolation tools to quarantine the server immediately.
### Short-term Improvements (1-3 months)
1. **Inventory Server Instances:** Identify all workstations running ScreenConnect server components (Web Server, Session Manager, Relay) and uninstall them if they are not strictly necessary.
2. **Credential Rotation:** Perform a mandatory password reset for all ScreenConnect administrative accounts and any accounts that share credentials with the ScreenConnect environment.
3. **Extension Audit:** Review `C:\Program Files (x86)\ScreenConnect\App_Extensions\` for unauthorized `.ashx` files within GUID-named subdirectories.
### Long-term Strategy (3+ months)
1. **Transition to Managed Services:** Consider migrating from on-premises hosting to the ScreenConnect Cloud version, which is automatically patched by the vendor.
2. **Zero Trust Architecture:** Implement strict access control lists (ACLs) and MFA for all remote access tools, ensuring they are not exposed directly to the open internet without a VPN or SASE gateway.
## Implementation Guidance
### For Small Organizations
- **Prioritize Patching:** Focus resources on ensuring every instance is at version 23.9.8+.
- **Manual Inspection:** Use the file path checks mentioned above to manually verify the integrity of the `App_Data` folder.
### For Medium Organizations
- **Service Hardening:** Disable unnecessary services (`ScreenConnect Relay`, `ScreenConnect Session Manager`) on endpoints that only require the client agent rather than the full server suite.
- **Centralized Logging:** Ensure Windows Event Logs are being ingested into a central repository to search for Event ID 4663.
### For Large Enterprises
- **Automated Scanning:** Use EDR or XDR tools to scan the entire fleet for the presence of the `SetupWizard.aspx/` string in web logs or event logs.
- **Service Control:** Use Group Policy or MDM to prevent the execution of ScreenConnect server services on unauthorized workstation subnets.
## Configuration Examples
### Service Management (To stop services during a suspected breach):
Execute the following via PowerShell or Command Prompt to kill active sessions:
powershell
Stop-Service "ScreenConnect Web Server"
Stop-Service "ScreenConnect Session Manager"
Stop-Service "ScreenConnect Security Manager"
Stop-Service "ScreenConnect Relay"
### Forensic Monitoring:
Monitor for unauthorized access to the setup wizard by filtering Windows Event Viewer:
- **Event ID:** 4663
- **Object Name:** Look for the specific string `SetupWizard.aspx/` (note the trailing slash, which indicates the exploit attempt).
## Compliance Alignment
- **NIST CSF:** ID.RA (Risk Assessment), PR.IP (Information Protection Processes and Procedures).
- **CIS Controls:** Control 7 (Vulnerability Management), Control 12 (Network Infrastructure Management).
- **ISO 27001:** A.12.6.1 (Management of technical vulnerabilities).
## Common Pitfalls to Avoid
- **Ignoring Workstations:** Assuming only "Servers" are at risk. ScreenConnect server components can be installed on standard Windows workstations.
- **Patching Without Investigating:** Simply patching does not remove backdoors (like "evil extensions") created *before* the patch was applied.
- **Overlooking Subdirectories:** Assuming GUID subdirectories in the Extensions folder are safe; they must be opened and the `.ashx` files inspected for malicious code.
## Resources
- **ConnectWise Security Bulletin:** [https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8]
- **Huntress Detection Guidance:** [https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2]
- **Official Patch Download:** [https://screenconnect.connectwise.com/download]