Ivanti Connect Secure dsinvoked Privilege Escalation via DSCache (CVE-2026-111357)

// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
let lookback = 24h;
Syslog
| where TimeGenerated >= ago(lookback)
| where SyslogMessage has "dsinvoked" or SyslogMessage has "DSCache"
| where SyslogMessage has_any ("modified", "write", "changed", "spawn", "exec", "uid=0", "root")
| extend Signal = case(
    SyslogMessage has "DSCache" and SyslogMessage has_any ("modified", "write", "changed"), "DSCacheConfigWrite",
    SyslogMessage has "dsinvoked" and SyslogMessage has_any ("spawn", "exec"), "BrokerSpawnedProcess",
    SyslogMessage has "uid=0" or SyslogMessage has "root", "RootContextAfterBroker",
    "Other")
| summarize Events = count(), Signals = make_set(Signal), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer
| where Signals has_any ("DSCacheConfigWrite", "BrokerSpawnedProcess")
| order by LastSeen desc

``` df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence ```
index=vpn (sourcetype="ivanti:connectsecure" OR sourcetype="pulse:connectsecure" OR sourcetype="syslog") (dsinvoked OR DSCache) earliest=-24h
| eval signal=case(
    match(_raw, "(?i)DSCache") AND match(_raw, "(?i)(modified|write|changed)"), "DSCacheConfigWrite",
    match(_raw, "(?i)dsinvoked") AND match(_raw, "(?i)(spawn|exec)"), "BrokerSpawnedProcess",
    match(_raw, "(?i)(uid=0|root)"), "RootContext",
    true(), null())
| where isnotnull(signal)
| stats count AS events values(signal) AS signals latest(_time) AS lastSeen earliest(_time) AS firstSeen BY host
| where like(mvjoin(signals, ","), "%DSCacheConfigWrite%") OR like(mvjoin(signals, ","), "%BrokerSpawnedProcess%")
| convert ctime(firstSeen) ctime(lastSeen)
| sort - lastSeen

// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
process where event.type == "start" and process.parent.name : "dsinvoked" and process.name : ("sh", "bash", "python*", "perl", "curl", "wget", "nc") and user.id == "0"

-- df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
SELECT sourceip, username, QIDNAME(qid) AS event_name, UTF8(payload) AS raw, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS event_time FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%ivanti%' AND (UTF8(payload) ILIKE '%dsinvoked%' OR UTF8(payload) ILIKE '%DSCache%') AND (UTF8(payload) ILIKE '%modified%' OR UTF8(payload) ILIKE '%spawn%' OR UTF8(payload) ILIKE '%uid=0%') ORDER BY starttime DESC LAST 24 HOURS

// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
_sourceCategory=*ivanti* OR _sourceCategory=*connectsecure* OR _sourceCategory=*pulse*
| where _raw matches /(?i)(dsinvoked|DSCache)/ and _raw matches /(?i)(modified|write|changed|spawn|exec|uid=0)/
| count by _sourceHost, _sourceCategory
| sort by _count desc

// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
rule ivanti_ics_dsinvoked_privesc_cve_2026_111357 {
  meta:
    author = "Argus"
    description = "dsinvoked or DSCache activity with root context on Ivanti Connect Secure (CVE-2026-111357)"
    severity = "HIGH"
  events:
    $e.metadata.product_name = /Ivanti|Connect Secure|Pulse/ nocase
    re.regex($e.target.process.command_line, `(dsinvoked|DSCache)`) nocase
    $e.principal.user.userid = "root"
    $host = $e.principal.hostname
  match:
    $host over 1h
  condition:
    $e
}

// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/dsinvoked/i
| FileName=/^(sh|bash|python[0-9.]*|perl|curl|wget|nc)$/i
| UserName=root
| table([_time, aid, ComputerName, ParentBaseFileName, FileName, CommandLine])