Detect Ivanti Connect Secure Authenticated Command Injection (CVE-2024-21887) in Microsoft Sentinel

let ivanti_paths = dynamic(['/api/v1/totp/user-backup-code/', '/api/v1/system/maintenance/archiving/cloud-server-test-connection', '/api/v1/configuration/users/user-roles/user-role/', '/api/v1/license/keys-status/']);
let suspicious_methods = dynamic(['POST', 'PUT', 'GET']);
union CommonSecurityLog, W3CIISLog, AzureDiagnostics
| where TimeGenerated >= ago(7d)
| where DeviceProduct has_any ('Ivanti', 'Pulse Secure', 'PCS') or csUriStem has_any ('/dana-ws/', '/dana-admin/', '/dana/', '/api/v1/')
| where (
    (csUriStem matches regex @'/api/v1/[a-z\-/]+' and csMethod in (suspicious_methods)) or
    (csUriStem has '/totp/user-backup-code') or
    (csUriStem has 'archiving/cloud-server-test-connection') or
    (csUriStem has 'maintenance')
  )
| extend RequestPath = coalesce(csUriStem, RequestUri, Column7)
| extend SourceIP = coalesce(cIP, c_ip, CallerIpAddress, SourceIP)
| extend ResponseCode = coalesce(sc_status, csStatus, toint(ResultCode))
| extend CommandInjectionIndicators = case(
    RequestPath matches regex @'[;|&`$(){}\[\]]', 'Shell metacharacters in path',
    RequestPath matches regex @'%3[Bb2Cc7c8Ee]', 'URL-encoded shell metacharacters',
    RequestPath has_any('wget', 'curl', 'bash', 'sh', 'python', 'perl', 'nc', 'ncat', 'chmod', 'base64'), 'Command in path',
    ''
  )
| where ResponseCode in (200, 201, 204) or isnotempty(CommandInjectionIndicators)
| project TimeGenerated, SourceIP, RequestPath, ResponseCode, CommandInjectionIndicators, csUserAgent, DeviceProduct
| order by TimeGenerated desc