Ivanti Connect Secure Authenticated Command Injection (Chained with CVE-2023-46805)

// CVE-2024-21887 — Ivanti Connect Secure Command Injection
// Detect suspicious web requests to Ivanti ICS endpoints that could indicate exploitation
// Key signals: anomalous URI patterns in ICS proxy/access logs, post-exploitation C2 traffic
let IvantiSuspiciousRequests =
W3CIISLog
| where TimeGenerated > ago(24h)
| where csHost has_any ("ivanti", "pulse", "pulsesecure", "connectsecure")
    or csUriStem has_any ("/dana-na/", "/dana/", "/api/v1/auth", "/api/v1/totp")
| where csUriStem has_any (
    "/../", "cmd", "exec", "shell", "wget", "curl", "/tmp",
    "base64", "python", "||", "&&"
  )
| extend ThreatIndicator = "CVE-2024-21887-Suspicious-ICS-Request";
let IvantiAnomalousAuth =
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has_any ("Ivanti", "Pulse Secure", "PulseSecure")
| where Activity has_any ("login", "auth", "session", "system", "exec")
| where Message has_any (
    "command", "inject", "exec", "shell", "root", "/tmp", "wget", "curl"
  )
| extend ThreatIndicator = "CVE-2024-21887-ICS-CommandInjection";
let PostExploitLateralMovement =
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (445, 3389, 22, 5985, 5986) // SMB, RDP, SSH, WinRM
| where RemoteIPType == "Private" // Post-exploit lateral movement to internal hosts
| summarize Connections=count(), Targets=make_set(RemoteIP)
  by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
| where Connections > 10 and array_length(Targets) > 5
| extend ThreatIndicator = "CVE-2024-21887-Post-Exploit-Lateral";
IvantiSuspiciousRequests
| union IvantiAnomalousAuth
| union PostExploitLateralMovement
| sort by TimeGenerated desc

index=network sourcetype IN ("ivanti:ics:log", "pulse:log", "syslog", "web:access")
(
  (vendor IN ("Ivanti", "Pulse Secure") OR sourcetype IN ("ivanti:ics:log", "pulse:log"))
  AND (
    (
      match(uri_path, "(?i)(/dana-na/|/dana/|/api/v1/auth|/api/v1/totp)")
      AND match(_raw, "(?i)(cmd|exec|shell|wget|curl|/tmp|base64|python|perl|\|\||&&)")
    )
    OR
    (
      (log_level IN ("SYSTEM", "ERROR", "WARNING") OR severity IN ("high", "critical"))
      AND match(message, "(?i)(command|inject|shell|root|execute|arbitrary)")
    )
  )
)
| eval CVE="CVE-2024-21887"
| eval ThreatType="Ivanti-ICS-CommandInjection"
| stats count AS SuspiciousRequests,
        values(src_ip) AS SourceIPs,
        values(uri_path) AS RequestPaths,
        values(message) AS LogMessages
  BY host, CVE, ThreatType, _time span=1h
| where SuspiciousRequests >= 1
| table _time, host, SourceIPs, RequestPaths, LogMessages, SuspiciousRequests, CVE, ThreatType
| sort - SuspiciousRequests