Coverage › CVE-2024-24919

CVE-2024-24919 Mapped Partial Sigma

Check Point Quantum Security Gateways Information Disclosure Vulnerability

Vendor / product

Check Point — Quantum Security Gateways

Description (CISA)

Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.

Added to KEV

2024-05-30

Due date

2024-06-20

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Known

CWE

CWE-200

CISA notes

https://support.checkpoint.com/results/sk/sk182336
https://nvd.nist.gov/vuln/detail/CVE-2024-24919

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003.003 NTDS secondary impact

• DET0586 Detection of NTDS.dit Credential Dumping from Domain Controllers
  AN1611 Windows

  Detects credential dumping attempts targeting the NTDS.dit database by monitoring shadow copy creation, suspicious file access to %SystemRoot%\NTDS\ntds.dit, and the use of tooling like ntdsutil.exe or volume management APIs.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=2 → DC0061 File Modification

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Microsoft-Windows-VSS Volume Shadow Copy Creation → DC0097 Volume Creation

  Tunable: TargetFilePath ParentProcessName TimeWindow UserContext

Sigma rules tagged attack.t1003.003 (24)

All 24 rules on the technique page →

T1003.008 /etc/passwd and /etc/shadow secondary impact

• DET0446 Credential Access via /etc/passwd and /etc/shadow Parsing
  AN1234 Linux

  Adversaries attempt to read sensitive files such as /etc/passwd and /etc/shadow for credential dumping. This may involve access to the files directly via command-line utilities (e.g., cat, less), creation of backup copies, or parsing through post-exploitation frameworks. Multi-event correlation includes elevated process execution, file access/read on sensitive paths, and anomalous read behaviors tied to non-root or unusual users.

  auditd:SYSCALL open, read → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: exe user PATH TimeWindow

Sigma rules tagged attack.t1003.008 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

T1005 Data from Local System primary impact

• DET0380 Detection of Local Data Collection Prior to Exfiltration
  AN1070 Windows

  Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TargetFilePathRegex ParentProcessFilter
  AN1071 Linux

  Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TimeWindow ScriptToolName
  AN1072 macOS

  Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

  macos:unifiedlog process:spawn → DC0032 Process Creation

  fs:fsusage read/write → DC0055 File Access

  Tunable: UserContext TargetVolume
  AN1073 Network Devices

  Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

  networkdevice:cli command logging → DC0064 Command Execution

  Tunable: CommandScope AuthenticatedUserList
  AN1074 ESXi

  Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

  esxis:vmkernel Datastore Access → DC0055 File Access

  esxi:hostd Command Execution → DC0064 Command Execution

  Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged attack.t1005 (14)

T1059.004 Unix Shell secondary impact

• DET0384 Behavioral Detection of Unix Shell Execution
  AN1081 Linux

  Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.

  auditd:SYSCALL execve → DC0032 Process Creation

  linux:osquery socket_events → DC0078 Network Traffic Flow

  linux:syslog auth.log / secure.log → DC0067 Logon Session Creation

  Tunable: ExecutableName UserContext ParentProcess TimeWindow CommandLinePattern
  AN1082 macOS

  Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.

  macos:unifiedlog log stream --predicate 'eventMessage contains "exec"' → DC0032 Process Creation

  macos:osquery launchd + process_events → DC0064 Command Execution

  macos:syslog system.log, asl.log → DC0029 Script Execution

  Tunable: ScriptLocation ParentProcess UserRole
  AN1083 ESXi

  Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.

  esxi:vmkernel DCUI shell start, BusyBox activity → DC0064 Command Execution

  esxi:auth Shell login or escalation → DC0067 Logon Session Creation

  Tunable: UserContext CommandPattern ShellPath
  AN1084 Network Devices

  Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.

  networkdevice:syslog CLI Command Audit → DC0064 Command Execution

  NSM:Flow remote access → DC0082 Network Connection Creation

  Tunable: Interface CommandString

Sigma rules tagged attack.t1059.004 (18)

All 18 rules on the technique page →

T1202 Indirect Command Execution exploitation technique

• DET0200 Indirect Command Execution – Windows utility abuse behavior chain
  AN0576 Windows

  Cause→effect chain: (1) A user or service launches an indirection utility (e.g., forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe, ssh.exe with -o ProxyCommand/LocalCommand). (2) That utility spawns a secondary program/command (PowerShell, cmd, msiexec, regsvr32, curl, arbitrary EXE) and/or opens outbound network connections. (3) Optional precursor modification of SSH config to persist LocalCommand/ProxyCommand. Correlate process creation, command/script content, file access to %USERPROFILE%\.ssh\config, and network connections from the utility or its child.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TimeWindow AllowedUtilities HighRiskChildren UserContext DestCIDRs

Sigma rules tagged attack.t1202 (40)

All 40 rules on the technique page →