Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: CVE-2022-36537 ConnectWise Recover RemoteAgent ASPX Webshell Drop
id: da76674e-7b46-43ba-a515-06c40af9b4cd
status: experimental
description: |
Detects exploitation of CVE-2022-36537 (CISA KEV) targeting ConnectWise Recover and LabTech.
Attackers upload a malicious ZIP file via the unauthenticated RemoteAgent handler, which is extracted
to the web root. This rule detects the subsequent execution of ASPX webshells in the vulnerable
'C:\Program Files\ConnectWise\...\' or 'C:\Program Files (x86)\LabTech\...\' paths by the IIS worker
process (w3wp.exe). This is a starting point — tune for your environment.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2022-36537
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.huntress.com/blog/cve-2022-36537-exploitation-via-connectwise-recover
date: 2026-08-15
author: SARA Detection Engineering
tags:
- attack.execution
- attack.t1059
- attack.persistence
- attack.t1505.003
logsource:
category: process_creation
product: windows
detection:
selection_iis_parent:
Image|endswith: '\w3wp.exe'
selection_webshell_path:
CommandLine|contains:
- '\Program Files\ConnectWise\'
- '\Program Files (x86)\LabTech\'
- '\Program Files (x86)\ScreenConnect\'
selection_webshell_ext:
CommandLine|contains:
- '.aspx'
- '.ashx'
- '.asmx'
condition: all of selection_*
falsepositives:
- Legitimate administrative ASPX pages deployed by ConnectWise software updates
- Custom integrations deployed by internal IT staff into the ConnectWise web root
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →