CVE-2026-50751 — Check Point Remote Access VPN / Mobile Access IKEv1 Authentication Bypass

Looks for: RA/Mobile Access VPN connections negotiated over IKEv1 — the exposed surface. Accomplishes: inventories who is still hitting the vulnerable path so you can migrate them and spot anomalies. ⚠ field names parser-dependent

// HUNT: Check Point RA/Mobile Access tunnels over deprecated IKEv1 (CVE-2026-50751 surface)
// MITRE: T1133, T1190 | CONF: medium  FP: medium  COST: low
// REQUIRES: Check Point VPN/SmartConsole logs ingested into LogScale/NG-SIEM
// FALSE POSITIVES: legitimate legacy clients still on IKEv1 (the population to migrate)
// TUNING: scope to RemoteAccess/MobileAccess blades; baseline known IKEv1 users, alert on new
vendor=/check\s*point/i OR product=/Remote Access|Mobile Access/i
| ike_version=/IKEv1/i
| blade=/Remote Access|Mobile Access/i
| table([@timestamp, src, user, cert_subject, ike_version, action, dst], limit=200)
| sort(@timestamp, order=desc)

Looks for: a successful RA tunnel-establish event whose session has no corresponding interactive-password authentication — the auth-bypass fingerprint. Accomplishes: the highest-fidelity SIEM signal for CVE-2026-50751. ⚠ field names parser-dependent

// HUNT: RA VPN tunnel established with no corresponding password-auth event (auth bypass)
// MITRE: T1556, T1190 | CONF: high  FP: low-med  COST: medium
// REQUIRES: tunnel-establish events + auth events correlatable by session/user
// FALSE POSITIVES: certificate-only deployments where no password event is expected
// TUNING: restrict to gateways/policies that DO require password auth; exclude machine-cert flows
vendor=/check\s*point/i
| blade=/Remote Access|Mobile Access/i
| groupBy([session_id, user, src], function=([
    collect([action, auth_method]),
    count(action, as=evts)
  ]))
| tunnel := if(action=/tunnel established|connected/i, 1, 0)
| pwauth := if(auth_method=/password|interactive|user/i, 1, 0)
| tunnel=1 AND pwauth=0
| table([session_id, user, src, action, auth_method], limit=200)

Looks for: RA tunnels from never-before-seen source IPs or unknown certificate subjects during the known exploitation window. FP: travelling users / new legitimate clients — baseline first. ⚠ field names parser-dependent

// HUNT: New source IP / unknown cert subject on the IKEv1 RA blade (CVE-2026-50751 window)
// MITRE: T1133, T1190 | CONF: medium  FP: medium  COST: low
// REQUIRES: Check Point RA VPN logs; a baseline window of known-good src/cert_subject
// FALSE POSITIVES: roaming users, newly provisioned clients
// TUNING: maintain an allow-list of known cert subjects; review unknowns since 2026-05-07
vendor=/check\s*point/i
| blade=/Remote Access|Mobile Access/i
| action=/tunnel established|connected|login/i
| groupBy([cert_subject, src], function=([min(@timestamp, as=firstSeen), count(user, as=n)]))
| firstSeen >= 1746576000000
| table([cert_subject, src, firstSeen, n], limit=200)
| sort(firstSeen, order=desc)

Looks for: a single remote source address (your RA VPN pool) logging on to many distinct internal hosts in a short window. FP: admin jump hosts, vuln scanners — allow-list. Replace the CIDR with your VPN client pool.

// HUNT: One VPN-pool source IP authenticating to many internal hosts (post-access spread)
// MITRE: T1021, T1133 | CONF: high  FP: medium  COST: medium
// REQUIRES: UserLogon with RemoteAddressIP4 populated; known VPN client pool CIDR
// FALSE POSITIVES: legitimate admin jump hosts / scanners from the VPN pool
// TUNING: set RemoteAddressIP4 to YOUR RA pool; allow-list sanctioned admin sources
#event_simpleName=/UserLogon|UserLogonFailed/
| RemoteAddressIP4=/^10\.200\./
| groupBy([RemoteAddressIP4, UserName], function=([
    count(ComputerName, distinct=true, as=hostsTouched),
    collect([ComputerName])
  ]))
| hostsTouched >= 5
| sort(hostsTouched, order=desc)

Looks for: shadow-copy, backup-catalog and boot-recovery deletion commands — the Qilin pre-encryption step. Accomplishes: high-fidelity ransomware staging detection independent of the VPN entry path.

// HUNT: Volume shadow / backup / recovery deletion ahead of encryption (Qilin kill-chain)
// MITRE: T1490 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 command-line telemetry
// FALSE POSITIVES: sanctioned backup maintenance — rare; allow-list backup service accounts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(vssadmin|wmic|bcdedit|wbadmin|powershell|cmd)\.exe$/i
| CommandLine=/(delete\s+shadows|shadowcopy\s+delete|resize\s+shadowstorage|deletecatalog|recoveryenabled\s+no|bootstatuspolicy\s+ignoreallfailures)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: one process touching an abnormally high number of distinct files in a short window — the encryption burst. FP: backup/indexing/AV — allow-list. Pair with Q5 on the same host for confidence.

// HUNT: Single process performing high-volume file modification (ransomware encryption burst)
// MITRE: T1486 | CONF: medium  FP: medium  COST: medium
// REQUIRES: FileCreateInfo / file-write telemetry with writing-process context
// FALSE POSITIVES: backup agents, search indexers, AV — allow-list by process
// TUNING: tune the threshold to your environment; correlate with Q5 hits on same aid
#event_simpleName=/PeFileWritten/
| FileName!=/^(MsMpEng|Backup|SearchIndexer|CSFalconService)\.exe$/i
| groupBy([aid, ContextProcessId, ContextBaseFileName], function=([
    count(TargetFileName, distinct=true, as=filesTouched),
    min(@timestamp, as=t0), max(@timestamp, as=t1)
  ]))
| filesTouched >= 200
| sort(filesTouched, order=desc)