Detect Ivanti EPMM Code Injection Exploitation (CVE-2026-1340) in Microsoft Sentinel

let SuspiciousEPMMPaths = dynamic(["/mifs/", "/mi/", "/api/v1/", "/api/v2/"]);
let InjectionPatterns = dynamic(["eval(", "exec(", "Runtime.exec", "ProcessBuilder", "ScriptEngine", "javax.script", "groovy", "ognl", "${{", "#{{"]);
union isfuzzy=true
(
    CommonSecurityLog
    | where DeviceVendor has_any ("Ivanti", "MobileIron")
    | where RequestURL has_any (SuspiciousEPMMPaths)
    | where Message has_any (InjectionPatterns) or RequestURL has_any (InjectionPatterns)
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, Message, DeviceVendor, DeviceProduct, EventOutcome
),
(
    W3CIISLog
    | where csUriStem has_any (SuspiciousEPMMPaths)
    | where csUriQuery has_any (InjectionPatterns) or csUriStem has_any (InjectionPatterns)
    | project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, csMethod
),
(
    AzureDiagnostics
    | where Category == "ApplicationGatewayFirewallLog"
    | where requestUri_s has_any (SuspiciousEPMMPaths)
    | where Message has_any (InjectionPatterns) or details_message_s has_any (InjectionPatterns)
    | project TimeGenerated, clientIp_s, requestUri_s, action_s, Message
)
| extend AccountCustomEntity = SourceIP, IPCustomEntity = SourceIP
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, RequestURL, RequestMethod
| where EventCount >= 1
| order by LastSeen desc