Detect Ivanti Connect Secure dsinvoked Privilege Escalation via DSCache (CVE-2026-111357) in Google Chronicle
Detects exploitation of CVE-2026-111357, an inclusion of functionality from an untrusted control sphere flaw (CWE-829 in NVD) in Ivanti Connect Secure where the dsinvoked broker trusts DSCache configuration data, letting a local authenticated attacker escalate to root. The CVE is on the CISA KEV catalog (added 2026-10-30, BOD 26-04) and is reported as chained with CVE-2026-104935 (unauthenticated command execution) and CVE-2026-118527 (controlled file upload), so a web-facing foothold is turned into full appliance control. Detection focuses on what the appliance and its log pipeline can show: writes to DSCache or dsinvoked configuration by an unexpected account or process, the dsinvoked broker spawning shells or interpreters, appliance-side processes switching from a service account to uid 0, and admin or system activity on the gateway that follows an unauthenticated web request pattern from the same source.
MITRE ATT&CK
- Tactic
- Privilege Escalation Execution
YARA-L Detection Query
// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
rule ivanti_ics_dsinvoked_privesc_cve_2026_111357 {
meta:
author = "Argus"
description = "dsinvoked or DSCache activity with root context on Ivanti Connect Secure (CVE-2026-111357)"
severity = "HIGH"
events:
$e.metadata.product_name = /Ivanti|Connect Secure|Pulse/ nocase
re.regex($e.target.process.command_line, `(dsinvoked|DSCache)`) nocase
$e.principal.user.userid = "root"
$host = $e.principal.hostname
match:
$host over 1h
condition:
$e
}Chronicle YARA-L rule for root-context dsinvoked or DSCache activity on Ivanti Connect Secure grouped per host.
Data Sources
Required Tables
False Positives & Tuning
- Authorised maintenance as root
- Vendor upgrade scripts
Other platforms for CVE-2026-111357
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.
- Test 1 Spawn a root shell from a stand-in broker process (lab)
Expected signal: Process creation events for sh and id as root, with a dsinvoked binary executed from /tmp.
Response Playbook
Triage
- Confirm the appliance runs an affected build (22.8 R2 through R2.5, or 25.1.0.0 through 25.1.1.2) per the Ivanti advisory.
- Identify the appliance, the time of the DSCache write or broker-spawned process, and any web requests to the gateway from the same source beforehand, since exploitation is reported as chained with CVE-2026-104935 and CVE-2026-118527.
- Check whether the activity matches an Ivanti upgrade, configuration import or authorised support case.
Containment
- Apply the Ivanti mitigations and patches, and follow BOD 26-04 for forensics triage; take the appliance out of service if mitigations are unavailable.
- Restrict management and gateway exposure while triaging, and rotate credentials and secrets stored on the appliance.
- Run Ivanti's Integrity Checker Tool and treat a failed or unavailable result as a compromise.
Evidence Collection
- Take an appliance snapshot and export system, admin access and event logs before any reboot or factory reset.
- Preserve DSCache and dsinvoked configuration files and the process list for comparison with a known-good build.
- Collect upstream web proxy, load balancer and firewall logs for the gateway for the surrounding window.
Escalation Criteria
- !Escalate to incident response on any unexplained DSCache modification or root-context process from dsinvoked.
- !Escalate if the integrity check fails or web shells or unknown files appear on the appliance.
- !Escalate if credentials stored on the gateway may have been exposed and are used elsewhere in the network.
Investigation Guide
Forensic Artifacts
- >
DSCache and dsinvoked configuration files on the appliance - >
Appliance system, admin and event logs - >
Ivanti Integrity Checker Tool output and unexpected files on the appliance filesystem
Tuning Guidance
Appliance log content for this flaw is thin, so treat these rules as medium or low fidelity and pair them with Ivanti's Integrity Checker Tool. Baseline dsinvoked and DSCache messages per appliance, allowlist change-managed upgrades, and prioritise alerts where an unauthenticated web request pattern from the same source precedes the local activity. Patching and the vendor mitigations are the definitive fix.
Hunting Queries
Builds a daily per-appliance baseline of dsinvoked and DSCache log activity so unusual bursts stand out around the 2026-10-13 disclosure.
// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
Syslog | where TimeGenerated > ago(14d) | where SyslogMessage has_any ("dsinvoked", "DSCache") | summarize Events = count() by Computer, bin(TimeGenerated, 1d) | order by Computer asc, TimeGenerated asc``` df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence ```
index=vpn (dsinvoked OR DSCache) earliest=-14d | timechart span=1d count by hostAtomic Red Team Tests
Simulates the telemetry the process rules key on by launching a shell as root from a process named dsinvoked on a Linux lab host. This does not exploit the vulnerability. Run only on a lab host.
Command
cp /bin/sleep /tmp/dsinvoked && sudo bash -c "/tmp/dsinvoked 1; sh -c 'id'"Cleanup
rm -f /tmp/dsinvokedExpected Telemetry
Process creation events for sh and id as root, with a dsinvoked binary executed from /tmp.
Expected Detection
Process-based rules fire only if the parent is dsinvoked; this test exercises the root-shell and process-name field mapping.