Detect Ivanti Connect Secure Authenticated Command Injection (Chained with CVE-2023-46805) in Microsoft Sentinel

// CVE-2024-21887 — Ivanti Connect Secure Command Injection
// Detect suspicious web requests to Ivanti ICS endpoints that could indicate exploitation
// Key signals: anomalous URI patterns in ICS proxy/access logs, post-exploitation C2 traffic
let IvantiSuspiciousRequests =
W3CIISLog
| where TimeGenerated > ago(24h)
| where csHost has_any ("ivanti", "pulse", "pulsesecure", "connectsecure")
    or csUriStem has_any ("/dana-na/", "/dana/", "/api/v1/auth", "/api/v1/totp")
| where csUriStem has_any (
    "/../", "cmd", "exec", "shell", "wget", "curl", "/tmp",
    "base64", "python", "||", "&&"
  )
| extend ThreatIndicator = "CVE-2024-21887-Suspicious-ICS-Request";
let IvantiAnomalousAuth =
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has_any ("Ivanti", "Pulse Secure", "PulseSecure")
| where Activity has_any ("login", "auth", "session", "system", "exec")
| where Message has_any (
    "command", "inject", "exec", "shell", "root", "/tmp", "wget", "curl"
  )
| extend ThreatIndicator = "CVE-2024-21887-ICS-CommandInjection";
let PostExploitLateralMovement =
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (445, 3389, 22, 5985, 5986) // SMB, RDP, SSH, WinRM
| where RemoteIPType == "Private" // Post-exploit lateral movement to internal hosts
| summarize Connections=count(), Targets=make_set(RemoteIP)
  by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
| where Connections > 10 and array_length(Targets) > 5
| extend ThreatIndicator = "CVE-2024-21887-Post-Exploit-Lateral";
IvantiSuspiciousRequests
| union IvantiAnomalousAuth
| union PostExploitLateralMovement
| sort by TimeGenerated desc