ncentral-compromise-ioc-triage — Updated!
Read-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints
N-central Compromise IoC Triage
Read-only defensive hunting toolkit for post-exploitation artifacts associated with N-able N-central authentication bypass vulnerabilities CVE-2026-18556 and CVE-2026-18577. The PowerShell endpoint scanner flags indicators published by N-able and Huntress; it never remediates or modifies the host.
Sources
| Vendor advisory | N-able — N-central Security Update (August 4, 2026) |
| Detection template | N-able developer recipe — CVE-2026-18577 detection |
| Independent research | Huntress — Critical N-able N-central Vulnerability and Active Exploitation |
| Unaffected build | N-central 2026.3.1.7 |
| Platform | Windows PowerShell 5.1+ (elevated) |
Several published attacker IPs are commercial VPN exit nodes (NordVPN / Mullvad). An IP match alone is not proof of compromise — correlate with Take Control session timing, viewer identity, ticket history, and endpoint persistence artifacts.
Quick start
Run an elevated PowerShell session on a managed Windows endpoint:
Set-ExecutionPolicy -Scope Process Bypass
.\scripts\Hunt-NcentralCompromise.ps1
Shorter lookback and CSV export:
.\scripts\Hunt-NcentralCompromise.ps1 -RecentDays 7 -CsvPath .\findings.csv
Push from an RMM (iocs.json must sit beside the scripts directory, or pass
-IocFile):
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\Hunt-NcentralCompromise.ps1 -OutputPath C:\Windows\Temp\ncentral-scan.json
Administrative rights are required for full coverage. Without them the scanner
exits 2; pass -AllowNonElevated to accept reduced coverage instead.
What is checked
| Check | Description |
|---|---|
| Cloudflared services | Exact service name Cloudflared, command lines invoking cloudflared.exe, and tunnel-style services launching from user profiles, ProgramData, or Temp |
| Cloudflared processes | Running processes whose image/command line looks like Cloudflare Tunnel |
| Documents svchost | Documents\svchost.exe under local user profiles (N-able published pivot) |
| Take Control logs | Recent BASupSrvc_*.log* / BASupTSHelper_*.log* under C:\ProgramData\GetSupportService_N-Central\Logs\ (recursive), streamed in full — including rolled .gz logs — for IOC IPs/domains |
| Application events | Event IDs 4102, 8192, and 8193, including close-together triads and messages mentioning MSP Support / published IPs |
Options
-IocFile PATH alternate IoC JSON (default ..\iocs.json)
-RecentDays N lookback for logs/events (default from IoCs)
-EventCorrelationWindowMinutes N triad clustering window (default 15)
-MaxLogScanBytes N per-log content-scan cap (default 64 MB)
-SkipServices / -SkipLogs / -SkipEvents / -SkipDocuments
-AllowNonElevated continue with reduced coverage when not admin
-OutputPath PATH JSON report path
-CsvPath PATH optional CSV export
-PassThru emit finding objects to the pipeline
Tests
Install-Module Pester -MinimumVersion 5.5.0 -Scope CurrentUser -Force -SkipPublisherCheck
.\tests\Invoke-Tests.ps1
The suite is read-only, needs no elevation, and runs entirely against synthetic
fixtures under TestDrive:.
Output and interpretation
Findings are [PSCustomObject] values with Severity, ArtifactType,
Details, Timestamp, Target, ComputerName, and Evidence. A timestamped
JSON report is written by default.
| Exit code | Meaning |
|---|---|
0 | No Critical or High findings |
1 | One or more Critical or High findings |
2 | Fatal scanner error (missing or malformed IoCs, not elevated, unexpected failure) |
Positive finding meaning: evidence consistent with published tradecraft was observed and should be investigated. Legitimate MSP Take Control usage and authorized cloudflared installs can overlap — treat Medium/Info items as context unless correlated with IOC infrastructure or unexplained sessions.
Project layout
iocs.json machine-readable indicators
scripts/Hunt-NcentralCompromise.ps1 Windows endpoint hunter
tests/Hunt-NcentralCompromise.Tests.ps1 Pester 5 suite
tests/Invoke-Tests.ps1 test runner
docs/ncentral-compromise-iocs.md human-readable IoC notes
docs/script-reference.md CLI / schema / exit codes
Documentation
License
MIT — see LICENSE.