Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)

// Microsoft Sentinel / Defender — anomalous ICS authentication from syslog/CEF ingestion
let lookback = 24h;
let authEndpoints = dynamic(["/dana-na/auth/url_default/welcome.cgi", "/dana-na/auth/url_admin/welcome.cgi", "/api/v1/auth", "/dana/home/index.cgi"]);
CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where DeviceVendor =~ "Ivanti" or DeviceProduct has_any ("Connect Secure", "Pulse Connect", "PCS", "ICS")
| where Activity has_any ("login", "auth", "session") or RequestURL has_any (authEndpoints)
| extend ReqUrl = tostring(RequestURL), User = coalesce(DestinationUserName, SourceUserName, "unknown")
| extend IsAuthSuccess = Activity has_any ("Login succeeded", "Authentication success", "session established")
| where IsAuthSuccess or ReqUrl has_any (authEndpoints)
| summarize Events = count(), Urls = make_set(ReqUrl, 20), Activities = make_set(Activity, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, User, DeviceName
| where Events >= 1
| extend SuspectSpoofedAuth = Activities has_any ("session established", "Login succeeded") and not(Activities has_any ("MFA", "credential", "password", "certificate validated"))
| where SuspectSpoofedAuth
| project FirstSeen, LastSeen, SourceIP, User, DeviceName, Events, Urls, Activities

index=vpn (sourcetype="ivanti:connectsecure" OR sourcetype="pulse:connectsecure" OR vendor="Ivanti")
| eval auth_success=if(match(event, "(?i)(login succeeded|authentication success|session established)"),1,0)
| eval cred_seen=if(match(event, "(?i)(mfa|password|credential|certificate validated|realm)"),1,0)
| transaction src_ip user maxspan=2m
| where auth_success=1 AND cred_seen=0
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(uri_path) AS urls values(event) AS activities by src_ip user host
| where events>=1
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

sequence by source.ip with maxspan=2m
  [ network where url.path like~ ("/dana-na/auth/*", "/api/v1/auth*", "/dana/home/*") and destination.domain != null ]
  [ authentication where event.outcome == "success" and event.provider in ("ivanti", "connectsecure", "pulse") and not user.name in ("system", "monitor") ]

SELECT sourceip, username, "URL" AS url, QIDNAME(qid) AS event_name, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS event_time FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%ivanti%' AND (QIDNAME(qid) ILIKE '%login succeeded%' OR QIDNAME(qid) ILIKE '%session established%' OR "URL" ILIKE '/dana-na/auth/%') AND NOT (QIDNAME(qid) ILIKE '%mfa%' OR QIDNAME(qid) ILIKE '%credential%' OR QIDNAME(qid) ILIKE '%certificate validated%') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*ivanti* OR _sourceCategory=*connectsecure*
| where (_raw matches /(?i)(login succeeded|authentication success|session established)/)
| if (_raw matches /(?i)(mfa|password|credential|certificate validated)/, 1, 0) as cred_seen
| where cred_seen = 0
| parse regex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" nodrop
| parse regex "user=(?<user>[^\s]+)" nodrop
| count by src_ip, user, _sourceHost
| where _count >= 1
| sort by _count desc

rule ivanti_connectsecure_auth_bypass_cve_2026_104935 {
  meta:
    author = "Argus"
    description = "Ivanti Connect Secure authentication success without credential validation (CVE-2026-104935)"
    severity = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104935"
  events:
    $e.metadata.vendor_name = /Ivanti/ nocase
    $e.metadata.product_name = /Connect Secure/ nocase
    $e.metadata.event_type = "USER_LOGIN"
    $e.security_result.action = "ALLOW"
    (
      $e.security_result.summary = /login succeeded|session established/ nocase
    )
    not $e.security_result.summary = /mfa|credential|certificate validated/ nocase
    $e.principal.ip = $src
  match:
    $src over 5m
  condition:
    $e
}

#event_simpleName=/.*/ | repo=vpn
| event_platform=/.*/ 
| (vendor=/Ivanti/i OR product=/Connect Secure/i)
| case {
    ActivityName=/login succeeded|session established/i | AuthSuccess := 1 ;
    * | AuthSuccess := 0
  }
| case {
    ActivityName=/mfa|credential|certificate validated/i | CredSeen := 1 ;
    * | CredSeen := 0
  }
| AuthSuccess=1 AND CredSeen=0
| groupBy([SourceIP, UserName, ComputerName], function=[count(as=events), min(@timestamp, as=first), max(@timestamp, as=last)])
| events >= 1
| sort(last, order=desc)