Skip to content
CVE-2026-111357 Microsoft Sentinel · KQL

Detect Ivanti Connect Secure dsinvoked Privilege Escalation via DSCache (CVE-2026-111357) in Microsoft Sentinel

Detects exploitation of CVE-2026-111357, an inclusion of functionality from an untrusted control sphere flaw (CWE-829 in NVD) in Ivanti Connect Secure where the dsinvoked broker trusts DSCache configuration data, letting a local authenticated attacker escalate to root. The CVE is on the CISA KEV catalog (added 2026-10-30, BOD 26-04) and is reported as chained with CVE-2026-104935 (unauthenticated command execution) and CVE-2026-118527 (controlled file upload), so a web-facing foothold is turned into full appliance control. Detection focuses on what the appliance and its log pipeline can show: writes to DSCache or dsinvoked configuration by an unexpected account or process, the dsinvoked broker spawning shells or interpreters, appliance-side processes switching from a service account to uid 0, and admin or system activity on the gateway that follows an unauthenticated web request pattern from the same source.

MITRE ATT&CK

Tactic
Privilege Escalation Execution

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
let lookback = 24h;
Syslog
| where TimeGenerated >= ago(lookback)
| where SyslogMessage has "dsinvoked" or SyslogMessage has "DSCache"
| where SyslogMessage has_any ("modified", "write", "changed", "spawn", "exec", "uid=0", "root")
| extend Signal = case(
    SyslogMessage has "DSCache" and SyslogMessage has_any ("modified", "write", "changed"), "DSCacheConfigWrite",
    SyslogMessage has "dsinvoked" and SyslogMessage has_any ("spawn", "exec"), "BrokerSpawnedProcess",
    SyslogMessage has "uid=0" or SyslogMessage has "root", "RootContextAfterBroker",
    "Other")
| summarize Events = count(), Signals = make_set(Signal), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer
| where Signals has_any ("DSCacheConfigWrite", "BrokerSpawnedProcess")
| order by LastSeen desc
high severity medium confidence

Flags Ivanti Connect Secure appliance syslog showing DSCache configuration writes or the dsinvoked broker launching processes, the observable footprint of the dsinvoked/DSCache privilege escalation in CVE-2026-111357.

Data Sources

SyslogIvanti Connect Secure appliance logs

Required Tables

Syslog

False Positives & Tuning

  • Ivanti-initiated upgrades or configuration imports that rewrite DSCache data
  • Support sessions where Ivanti engineers run diagnostics as root
  • Appliance restarts that re-initialise the dsinvoked broker

Other platforms for CVE-2026-111357

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.

  1. Test 1 Spawn a root shell from a stand-in broker process (lab)

    Expected signal: Process creation events for sh and id as root, with a dsinvoked binary executed from /tmp.

Last updated: Research depth: standard
References (3)

Response Playbook

Triage

  1. Confirm the appliance runs an affected build (22.8 R2 through R2.5, or 25.1.0.0 through 25.1.1.2) per the Ivanti advisory.
  2. Identify the appliance, the time of the DSCache write or broker-spawned process, and any web requests to the gateway from the same source beforehand, since exploitation is reported as chained with CVE-2026-104935 and CVE-2026-118527.
  3. Check whether the activity matches an Ivanti upgrade, configuration import or authorised support case.

Containment

  1. Apply the Ivanti mitigations and patches, and follow BOD 26-04 for forensics triage; take the appliance out of service if mitigations are unavailable.
  2. Restrict management and gateway exposure while triaging, and rotate credentials and secrets stored on the appliance.
  3. Run Ivanti's Integrity Checker Tool and treat a failed or unavailable result as a compromise.

Evidence Collection

  1. Take an appliance snapshot and export system, admin access and event logs before any reboot or factory reset.
  2. Preserve DSCache and dsinvoked configuration files and the process list for comparison with a known-good build.
  3. Collect upstream web proxy, load balancer and firewall logs for the gateway for the surrounding window.

Escalation Criteria

  • !Escalate to incident response on any unexplained DSCache modification or root-context process from dsinvoked.
  • !Escalate if the integrity check fails or web shells or unknown files appear on the appliance.
  • !Escalate if credentials stored on the gateway may have been exposed and are used elsewhere in the network.

Investigation Guide

Forensic Artifacts

  • >DSCache and dsinvoked configuration files on the appliance
  • >Appliance system, admin and event logs
  • >Ivanti Integrity Checker Tool output and unexpected files on the appliance filesystem

Tuning Guidance

Appliance log content for this flaw is thin, so treat these rules as medium or low fidelity and pair them with Ivanti's Integrity Checker Tool. Baseline dsinvoked and DSCache messages per appliance, allowlist change-managed upgrades, and prioritise alerts where an unauthenticated web request pattern from the same source precedes the local activity. Patching and the vendor mitigations are the definitive fix.

Hunting Queries

Builds a daily per-appliance baseline of dsinvoked and DSCache log activity so unusual bursts stand out around the 2026-10-13 disclosure.

Hunting — KQL
kql 
// df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence
Syslog | where TimeGenerated > ago(14d) | where SyslogMessage has_any ("dsinvoked", "DSCache") | summarize Events = count() by Computer, bin(TimeGenerated, 1d) | order by Computer asc, TimeGenerated asc
Hunting — SPL
spl 
``` df00tech DF00-8b0ddc3d84 · https://df00tech.com/detections/CVE-2026-111357 · licence: https://df00tech.com/detections/licence ```
index=vpn (dsinvoked OR DSCache) earliest=-14d | timechart span=1d count by host

Atomic Red Team Tests

Test 1 Spawn a root shell from a stand-in broker process (lab)
linux

Simulates the telemetry the process rules key on by launching a shell as root from a process named dsinvoked on a Linux lab host. This does not exploit the vulnerability. Run only on a lab host.

Command

bash 
cp /bin/sleep /tmp/dsinvoked && sudo bash -c "/tmp/dsinvoked 1; sh -c 'id'"

Cleanup

bash 
rm -f /tmp/dsinvoked

Expected Telemetry

Process creation events for sh and id as root, with a dsinvoked binary executed from /tmp.

Expected Detection

Process-based rules fire only if the parent is dsinvoked; this test exercises the root-shell and process-name field mapping.

Related Detections

Tactic Hubs

TA0004 Privilege Escalation TA0002 Execution ATT&CK Matrix

Related Techniques

T1068 Exploitation for Privilege Escalation T1190 Exploit Public-Facing Application T1505.003 Web Shell

Same Tactic: Privilege Escalation

Popular Detections