🔍 Investigating a Zero-Day Attack Using Let’s Defend SIEM

👉 A Walkthrough on Detecting and Analyzing CVE-2024-24919 Exploitation

🎯 Purpose of the Investigation

This project was conducted to investigate a potential exploitation attempt against a Check Point Security Gateway, specifically leveraging a zero-day vulnerability – CVE-2024-24919. The goal was to determine if this alert was a false positive or a legitimate breach attempt, analyze the traffic, and take appropriate containment and response steps.

🛠️ Tools & Environment Used

SIEM Platform: Let’s Defend (cloud-based threat detection and investigation tool)
Virtual Lab: Provided within Let’s Defend
Targeted Host: CP-Spark-Gateway-01
Log Analysis Features: HTTP traffic logs, endpoint filtering, email security console
Threat Intelligence: Online sources such as NVD and Check Point security advisories

⭐ Alert Overview

Rule Triggered: SOC287 - Arbitrary File Read on Check Point Gateway (CVE-2024-24919)
Event ID: 263
Timestamp: June 6, 2024, 03:12 PM
Destination IP: 172.16.20.146
Source IP: 203.160.68.12
Device Action: Allowed
Request: aCSHELL/../../../../../../../../../../etc/passwd
User-Agent: Spoofed as Mozilla Firefox on Mac OS X

🧪 Pre-Analysis: Understanding CVE-2024-24919

CVE-2024-24919 is a zero-day path traversal vulnerability affecting Check Point Security Gateways. It allows unauthenticated remote attackers to read arbitrary files, such as /etc/passwd and /etc/shadow, by sending crafted HTTP requests to vulnerable endpoints.

🔗 Check Point Advisory

This type of request (seen in our logs) is consistent with this vulnerability and triggers alerts due to its attempt to exploit system file reads.

🔎 Step 1: Analyze HTTP Traffic

I navigated to the Log Management page, filtered for Destination IP 172.16.20.146, and inspected incoming HTTP traffic.

🔥 Key Findings:

Timestamp	Request Path	Payload
15:12:45	/clients/MyCRL	`aCSHELL/../../../../etc/passwd`
15:13:10	/clients/MyCRL	`aCSHELL/../../../../etc/shadow`

The payload clearly attempts path traversal to read critical system files.
These files are used to store user credentials and password hashes.
HTTP Status 200 with Response Size: 1256 bytes indicates the server returned data successfully — suggesting exploitation succeeded.

🚨 Step 2: What Type of Attack Is This?

This is a Path Traversal Attack, also known as Directory Traversal. It allows attackers to navigate outside the intended web directory and access protected system files.

Why we concluded this:

Requests contain repeated ../ (dot-dot-slash) patterns.
Targeted files like /etc/passwd and /etc/shadow are standard indicators.

🧪 Step 3: Was This a Planned Test?

I checked the Email Security Page and searched using these keywords:

172.16.20.146
CP-Spark-Gateway-01
CVE-2024-24919
penetration test

🔍 No emails or documentation suggested this was a test. This likely rules out a simulation or red-team operation.

🌐 Step 4: Traffic Direction Analysis

Source IP: 203.160.68.12 → Public IP Address Destination IP: 172.16.20.146 → Private IP Address (RFC 1918 range)

🔁 Direction: Internet → Company Network

This confirms the traffic is coming from an external attacker targeting internal infrastructure.

🧠 Step 5: Was the Attack Successful?

The HTTP log shows:

"POST /clients/MyCRL HTTP/1.1" 200 1256

HTTP 200 OK indicates success.
Response size (1256 bytes) suggests the system returned data.
The attacker likely accessed /etc/passwd, validating a successful exploit.

🛡️ Containment Steps

I accessed the Endpoint page, filtered by the destination IP 172.16.20.146, and issued a containment action to isolate the host.

Why?

Host has been compromised.
It could be used to pivot or exfiltrate data.

🧾 Step 6: Documenting IOCs

Why It Matters:

Indicators of Compromise (IOCs) are crucial for:

Notifying external threat intelligence communities
Writing future detection rules
Strengthening security posture

📌 IOCs Identified:

Source IP: 203.160.68.12, 203.160.68.13
User-Agent: Mozilla/5.0 (Mac OS X; rv:126.0)
Request Paths:
- /clients/MyCRL
- Payloads: ../../../../etc/passwd, ../../../../etc/shadow
Target Port: 4433 (non-standard HTTPS)

⬆️ Step 7: Tier 2 Escalation?

✅ Yes — This is a zero-day vulnerability successfully exploited in a live environment, exposing sensitive files.

Escalation is essential for:

Deep forensics
Patch validation
Coordinating legal, compliance, and executive stakeholders

📄 Step 8: Final Analysis & Comment

I closed the alert as a True Positive.

Most Popular

Detecting-and-Analyzing-CVE-2024-24919-Exploitation