CVE-2024-1709

ScreenConnect User Database Modification - Security

Apr 28, 2026 · cve.2024-1709 detection.emerging-threats attack.defense-impairment ·

This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation

Jan 30, 2025 · attack.initial-access attack.persistence cve.2024-1709 detection.emerging-threats ·

Share on:

Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.

ScreenConnect User Database Modification

Jan 30, 2025 · attack.persistence cve.2024-1709 detection.emerging-threats ·

Share on:

Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.