1name: crowdsecurity/vpatch-connectwise-auth-bypass
2description: "Detect exploitation of auth bypass in ConnectWise ScreenConnect"
3rules:
4  - zones:
5    - URI
6    transform:
7    - lowercase
8    match:
9      type: endsWith
10      value: /setupwizard.aspx/
11labels:
12  type: exploit
13  service: http
14  confidence: 3
15  spoofable: 0
16  behavior: "http:exploit"
17  label: "ConnectWise ScreenConnect - Authentication Bypass"
18  classification:
19   - attack.T1595
20   - attack.T1190
21   - cve.CVE-2024-1709
22