N-central Compromise IoC Triage

Read-only defensive hunting toolkit for post-exploitation artifacts associated with N-able N-central authentication bypass vulnerabilities CVE-2026-18556 and CVE-2026-18577. The PowerShell endpoint scanner flags indicators published by N-able and Huntress; it never remediates or modifies the host.

Sources

Vendor advisory	N-able — N-central Security Update (August 4, 2026)
Detection template	N-able developer recipe — CVE-2026-18577 detection
Independent research	Huntress — Critical N-able N-central Vulnerability and Active Exploitation
Unaffected build	N-central 2026.3.1.7
Platform	Windows PowerShell 5.1+ (elevated)

Several published attacker IPs are commercial VPN exit nodes (NordVPN / Mullvad). An IP match alone is not proof of compromise — correlate with Take Control session timing, viewer identity, ticket history, and endpoint persistence artifacts.

Quick start

Run an elevated PowerShell session on a managed Windows endpoint:

Set-ExecutionPolicy -Scope Process Bypass
.\scripts\Hunt-NcentralCompromise.ps1

Shorter lookback and CSV export:

.\scripts\Hunt-NcentralCompromise.ps1 -RecentDays 7 -CsvPath .\findings.csv

Push from an RMM (iocs.json must sit beside the scripts directory, or pass -IocFile):

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\Hunt-NcentralCompromise.ps1 -OutputPath C:\Windows\Temp\ncentral-scan.json

Administrative rights are required for full coverage. Without them the scanner exits 2; pass -AllowNonElevated to accept reduced coverage instead.

What is checked

Check	Description
Cloudflared services	Exact service name Cloudflared, command lines invoking cloudflared.exe, and tunnel-style services launching from user profiles, ProgramData, or Temp
Cloudflared processes	Running processes whose image/command line looks like Cloudflare Tunnel
Documents svchost	Documents\svchost.exe under local user profiles (N-able published pivot)
Take Control logs	Recent BASupSrvc_*.log* / BASupTSHelper_*.log* under C:\ProgramData\GetSupportService_N-Central\Logs\ (recursive), streamed in full — including rolled .gz logs — for IOC IPs/domains
Application events	Event IDs 4102, 8192, and 8193, including close-together triads and messages mentioning MSP Support / published IPs

Options

-IocFile PATH                         alternate IoC JSON (default ..\iocs.json)
-RecentDays N                         lookback for logs/events (default from IoCs)
-EventCorrelationWindowMinutes N      triad clustering window (default 15)
-MaxLogScanBytes N                    per-log content-scan cap (default 64 MB)
-SkipServices / -SkipLogs / -SkipEvents / -SkipDocuments
-AllowNonElevated                     continue with reduced coverage when not admin
-OutputPath PATH                      JSON report path
-CsvPath PATH                         optional CSV export
-PassThru                             emit finding objects to the pipeline

Tests

Install-Module Pester -MinimumVersion 5.5.0 -Scope CurrentUser -Force -SkipPublisherCheck
.\tests\Invoke-Tests.ps1

The suite is read-only, needs no elevation, and runs entirely against synthetic fixtures under TestDrive:.

Output and interpretation

Findings are [PSCustomObject] values with Severity, ArtifactType, Details, Timestamp, Target, ComputerName, and Evidence. A timestamped JSON report is written by default.

Exit code	Meaning
0	No Critical or High findings
1	One or more Critical or High findings
2	Fatal scanner error (missing or malformed IoCs, not elevated, unexpected failure)

Positive finding meaning: evidence consistent with published tradecraft was observed and should be investigated. Legitimate MSP Take Control usage and authorized cloudflared installs can overlap — treat Medium/Info items as context unless correlated with IOC infrastructure or unexplained sessions.

Project layout

iocs.json                                    machine-readable indicators
scripts/Hunt-NcentralCompromise.ps1          Windows endpoint hunter
tests/Hunt-NcentralCompromise.Tests.ps1      Pester 5 suite
tests/Invoke-Tests.ps1                       test runner
docs/ncentral-compromise-iocs.md             human-readable IoC notes
docs/script-reference.md                     CLI / schema / exit codes

Documentation

• IoC notes
• Script reference
• Contributing
• Agent guide

License

MIT — see LICENSE.