Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP ConnectWise ScreenConnect authentication bypass attempt

Rule Explanation

This rule looks for requests to the ConnectWise ScreenConnect "/SetupWizard.aspx" endpoint that are intended to bypass authentication checks for this resource.

What To Look For

This rule looks for attempts to exploit an authentication bypass vulnerability in ConnectWise ScreenConnect.

Known Usage

Attacks/Scans seen in the wild

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

Rule Categories::Server::Web Applications

MITRE::ATT&CK Framework::Enterprise::Initial Access::Exploit Public-Facing Application

CVE

Additional Links

Rule Vulnerability

Authentication Bypass

An Authentication Bypass occurs when there is a way to avoid providing user credentials to a system before performing restricted operations on said system.

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2024-1709
Loading description
CVE-2024-27215
Loading description