CVE-2026-1281 — Ivanti EPMM Code Injection Exploitation

let epmm_processes = dynamic(['java', 'tomcat', 'mi-dm', 'openapi-generator', 'mics']);
let suspicious_children = dynamic(['cmd.exe', 'powershell.exe', 'sh', 'bash', 'curl', 'wget', 'python', 'python3', 'perl', 'nc', 'ncat', 'nmap']);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated >= ago(7d)
| where (InitiatingProcessFileName has_any (epmm_processes) or ParentProcessName has_any (epmm_processes))
| where (ProcessCommandLine has_any (suspicious_children) or FileName has_any (suspicious_children))
| extend RiskScore = case(
    ProcessCommandLine has 'whoami' or ProcessCommandLine has 'id', 'HIGH',
    ProcessCommandLine has 'wget' or ProcessCommandLine has 'curl', 'HIGH',
    ProcessCommandLine has 'chmod' or ProcessCommandLine has 'base64', 'MEDIUM',
    'LOW'
  )
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, ParentProcessName, RiskScore
| order by TimeGenerated desc

index=endpoint OR index=os sourcetype IN ("linux_secure", "WinEventLog:Security", "xmlwineventlog", "crowdstrike:events:sensor")
| eval parent_lower=lower(parent_process_name), proc_lower=lower(process_name), cmdline_lower=lower(process_cmdline)
| where (match(parent_lower, "(java|tomcat|mi-dm|mics|openapi)"))
  AND (match(proc_lower, "(cmd\.exe|powershell|bash|sh|curl|wget|python|perl|nc|ncat|nmap)"))
| eval risk=case(
    match(cmdline_lower, "(whoami|id|uname|hostname)"), "HIGH",
    match(cmdline_lower, "(wget|curl|tftp|scp)"), "HIGH",
    match(cmdline_lower, "(base64|chmod 777|chmod \\+x)"), "MEDIUM",
    true(), "LOW"
  )
| table _time, host, user, parent_process_name, process_name, process_cmdline, risk
| sort -_time

sequence by host.name with maxspan=2m
  [process where event.type == "start"
    and process.parent.name : ("java", "tomcat", "mi-dm", "mics")
    and process.name : ("sh", "bash", "curl", "wget", "python", "python3", "perl", "nc", "ncat")]
  [any where event.category == "network"
    and network.direction == "egress"
    and not destination.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time,
       sourceip, destinationip, username,
       "processname", "parentprocessname", "commandline",
       logsourcename(logsourceid) as log_source
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Microsoft Windows Security Event Log', 'CrowdStrike Falcon')
  AND (LOWER("parentprocessname") ILIKE '%java%'
    OR LOWER("parentprocessname") ILIKE '%tomcat%'
    OR LOWER("parentprocessname") ILIKE '%mi-dm%'
    OR LOWER("parentprocessname") ILIKE '%mics%')
  AND (LOWER("processname") ILIKE '%bash%'
    OR LOWER("processname") ILIKE '%sh%'
    OR LOWER("processname") ILIKE '%curl%'
    OR LOWER("processname") ILIKE '%wget%'
    OR LOWER("processname") ILIKE '%python%'
    OR LOWER("processname") ILIKE '%perl%')
ORDER BY starttime DESC
LAST 7 DAYS

_sourceCategory=endpoint/process OR _sourceCategory=os/linux/secure OR _sourceCategory=windows/security
| json auto
| where (toLowerCase(parentProcessName) matches "*(java|tomcat|mi-dm|mics|openapi)*")
  and (toLowerCase(processName) in ("sh", "bash", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "cmd.exe", "powershell.exe"))
| eval risk = if(processCommandLine matches "*(whoami|id|wget|curl|base64)*", "HIGH", "MEDIUM")
| fields _messageTime, hostname, user, parentProcessName, processName, processCommandLine, risk
| sort by _messageTime desc

rule cve_2026_1281_epmm_code_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-1281 Ivanti EPMM code injection exploitation via suspicious child process spawning"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(java|tomcat|mi-dm|mics|openapi-generator)/
    $proc.target.process.file.full_path = /(?i)(bash|sh|curl|wget|python3?|perl|nc|ncat|cmd\.exe|powershell\.exe)/
  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("java", "tomcat", "mi-dm", "mics", "openapi-generator")
| FileName in ("sh", "bash", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "cmd.exe", "powershell.exe")
| eval Risk = case(
    CommandLine =~ "(?i)(whoami|id|uname|hostname|cat /etc/passwd)", "HIGH",
    CommandLine =~ "(?i)(wget|curl|tftp|scp|python.*http)", "HIGH",
    CommandLine =~ "(?i)(chmod|base64|xxd)", "MEDIUM",
    true(), "LOW"
  )
| table _time, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, Risk
| sort -_time
| limit 500