Inferlume

title: Check Point VPN Authentication Bypass Attempt CVE-2026-50751
status: experimental
description: Detects VPN session establishments on Check Point appliances where certificate validation indicators are absent or malformed
logsource:
  product: checkpoint
  service: vpn
detection:
  selection:
    EventID: 'VPN_AUTH_SUCCESS'
    auth_method: 'certificate'
  filter_invalid_cert:
    cert_subject: ''
    cert_issuer: ''
  filter_ikev1:
    ike_version: '1'
  timeframe:
    condition: gte 3 within 5m
  condition: selection AND (filter_invalid_cert OR filter_ikev1)
falsepositives:
  - Legacy IKEv1 clients with valid certificates
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-50751

index=checkpoint sourcetype=checkpoint:vpn 
| where ike_version="1" AND (isnull(cert_subject) OR cert_subject="") 
| stats count by src_ip, dst_ip, auth_method, _time 
| where count >= 2 
| eval alert="Possible CVE-2026-50751 Exploitation Certless IKEv1 VPN Auth" 
| table _time, src_ip, dst_ip, auth_method, count, alert

rule Windows_Kernel_RCE_Stager_Generic {
    meta:
        description = "Heuristic kernel mode RCE shellcode indicators June 2026 Patch Tuesday context"
        author = "Inferlume CTI"
        date = "2026-06-10"
        severity = "HIGH"
    strings:
        $nt_alloc = "NtAllocateVirtualMemory" nocase
        $nt_write  = "NtWriteVirtualMemory" nocase
        $nt_create = "NtCreateThreadEx" nocase
        $shellcode_nop = { 90 90 90 90 CC CC CC CC }
        $tcpip_anomaly = "tcpip.sys" nocase
    condition:
        3 of ($nt_alloc, $nt_write, $nt_create) and
        ($shellcode_nop or $tcpip_anomaly)
}