Ivanti EPMM Code Injection Exploitation (CVE-2026-1340)

let SuspiciousEPMMPaths = dynamic(["/mifs/", "/mi/", "/api/v1/", "/api/v2/"]);
let InjectionPatterns = dynamic(["eval(", "exec(", "Runtime.exec", "ProcessBuilder", "ScriptEngine", "javax.script", "groovy", "ognl", "${{", "#{{"]);
union isfuzzy=true
(
    CommonSecurityLog
    | where DeviceVendor has_any ("Ivanti", "MobileIron")
    | where RequestURL has_any (SuspiciousEPMMPaths)
    | where Message has_any (InjectionPatterns) or RequestURL has_any (InjectionPatterns)
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, Message, DeviceVendor, DeviceProduct, EventOutcome
),
(
    W3CIISLog
    | where csUriStem has_any (SuspiciousEPMMPaths)
    | where csUriQuery has_any (InjectionPatterns) or csUriStem has_any (InjectionPatterns)
    | project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, csMethod
),
(
    AzureDiagnostics
    | where Category == "ApplicationGatewayFirewallLog"
    | where requestUri_s has_any (SuspiciousEPMMPaths)
    | where Message has_any (InjectionPatterns) or details_message_s has_any (InjectionPatterns)
    | project TimeGenerated, clientIp_s, requestUri_s, action_s, Message
)
| extend AccountCustomEntity = SourceIP, IPCustomEntity = SourceIP
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, RequestURL, RequestMethod
| where EventCount >= 1
| order by LastSeen desc

index=* sourcetype IN ("ivanti:epmm", "mobileiron", "iis", "apache", "nginx", "pan:traffic", "cisco:asa")
(uri="/mifs/*" OR uri="/mi/*" OR uri="/api/v1/*" OR uri="/api/v2/*"
 OR url="/mifs/*" OR url="/mi/*" OR url="/api/v1/*" OR url="/api/v2/*"
 OR request="/mifs/*" OR request="/mi/*")
(
  (uri="*eval(*" OR uri="*exec(*" OR uri="*Runtime.exec*" OR uri="*ProcessBuilder*" OR uri="*groovy*" OR uri="*ognl*" OR uri="*javax.script*" OR uri="*${*" OR uri="*#{*")
  OR (request="*eval(*" OR request="*exec(*" OR request="*ProcessBuilder*" OR request="*groovy*" OR request="*ognl*")
  OR (body="*eval(*" OR body="*exec(*" OR body="*ProcessBuilder*" OR body="*ScriptEngine*" OR body="*groovy*" OR body="*ognl*")
)
| eval risk_score=case(
    match(uri, "Runtime\.exec|ProcessBuilder|ScriptEngine"), 90,
    match(uri, "ognl|groovy"), 85,
    match(uri, "eval\(|exec\("), 80,
    true(), 70
  )
| stats count AS request_count, max(risk_score) AS max_risk, values(uri) AS uris, values(status) AS status_codes, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, dest_ip
| where request_count >= 1
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - max_risk

sequence by source.ip with maxspan=5m
  [network where destination.port in (443, 8443, 80, 8080)
   and url.path : ("/mifs/*", "/mi/*", "/api/v1/*", "/api/v2/*")
   and (
     url.query : ("*eval(*", "*exec(*", "*groovy*", "*ognl*", "*ProcessBuilder*", "*ScriptEngine*", "*Runtime.exec*", "*${*", "*#{*")
     or url.path : ("*eval(*", "*exec(*", "*groovy*", "*ognl*", "*ProcessBuilder*")
   )
  ]
  [network where destination.port in (443, 8443, 80, 8080)
   and http.response.status_code in (200, 201, 302)
  ]

SELECT
  sourceip,
  destinationip,
  URL,
  "Method",
  "Response Code",
  starttime,
  username,
  QIDNAME(qid) AS EventName,
  logsourcename(logsourceid) AS LogSource
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Ivanti EPMM', 'MobileIron MDM', 'Apache HTTP Server', 'Microsoft IIS', 'F5 BIG-IP')
  AND (
    URL ILIKE '%/mifs/%'
    OR URL ILIKE '%/mi/%'
    OR URL ILIKE '%/api/v1/%'
    OR URL ILIKE '%/api/v2/%'
  )
  AND (
    URL ILIKE '%eval(%'
    OR URL ILIKE '%exec(%'
    OR URL ILIKE '%Runtime.exec%'
    OR URL ILIKE '%ProcessBuilder%'
    OR URL ILIKE '%groovy%'
    OR URL ILIKE '%ognl%'
    OR URL ILIKE '%ScriptEngine%'
    OR URL ILIKE '%javax.script%'
    OR URL ILIKE '%${%'
    OR URL ILIKE '%#{%'
  )
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=ivanti/epmm OR _sourceCategory=mobileiron OR _sourceCategory=webserver/access
| where (%"cs-uri-stem" matches "/mifs/*" or %"cs-uri-stem" matches "/mi/*" or %"cs-uri-stem" matches "/api/v1/*" or %"cs-uri-stem" matches "/api/v2/*"
  or url matches "/mifs/*" or url matches "/mi/*" or url matches "/api/v1/*" or url matches "/api/v2/*")
| where (%"cs-uri-stem" matches "*eval(*" or %"cs-uri-stem" matches "*exec(*" or %"cs-uri-stem" matches "*ProcessBuilder*" or %"cs-uri-stem" matches "*groovy*" or %"cs-uri-stem" matches "*ognl*"
  or url matches "*eval(*" or url matches "*exec(*" or url matches "*ProcessBuilder*" or url matches "*groovy*" or url matches "*ognl*"
  or %"cs-uri-query" matches "*eval(*" or %"cs-uri-query" matches "*ProcessBuilder*" or %"cs-uri-query" matches "*groovy*")
| parse field=srcip "*" as source_ip nodrop
| parse field=%"c-ip" "*" as source_ip nodrop
| count by source_ip, url, %"sc-status"
| sort by _count desc

rule ivanti_epmm_code_injection_cve_2026_1340 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects code injection exploitation attempts against Ivanti EPMM (CVE-2026-1340)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-1340"
    cve = "CVE-2026-1340"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.target.url.path = /\/(mifs|mi|api\/v[12])\//
    (
      $http.target.url.path = /eval\(|exec\(|Runtime\.exec|ProcessBuilder|groovy|ognl|ScriptEngine|javax\.script|\$\{|#\{/
      or $http.target.url.query = /eval\(|exec\(|Runtime\.exec|ProcessBuilder|groovy|ognl|ScriptEngine|\$\{|#\{/
    )
    $http.network.http.response_code != 400
    $http.network.http.response_code != 403
  condition:
    $http
}

#event_simpleName=HttpRequest
| ContextBaseFileName = "java" OR ContextBaseFileName = "catalina.sh" OR ContextBaseFileName = "startup.sh"
| (HttpUrl = "/mifs/*" OR HttpUrl = "/mi/*" OR HttpUrl = "/api/v1/*" OR HttpUrl = "/api/v2/*")
| (HttpUrl = "*eval(*" OR HttpUrl = "*exec(*" OR HttpUrl = "*ProcessBuilder*" OR HttpUrl = "*groovy*" OR HttpUrl = "*ognl*" OR HttpUrl = "*ScriptEngine*" OR HttpUrl = "*Runtime.exec*" OR HttpUrl = "*${*" OR HttpUrl = "*#{*"
   OR HttpPayload = "*eval(*" OR HttpPayload = "*exec(*" OR HttpPayload = "*ProcessBuilder*" OR HttpPayload = "*groovy*" OR HttpPayload = "*ognl*")
| groupBy([RemoteAddressIP4, HttpUrl, HttpMethod], function=count(1, as=RequestCount))
| sort(RequestCount, order=desc)