Ivanti Endpoint Manager (EPM) Authentication Bypass (CVE-2026-1603)

let EPMHosts = DeviceNetworkInfo
| where isnotempty(MacAddress)
| extend HostName = DeviceName
| project DeviceId, HostName;
DeviceNetworkEvents
| where RemotePort in (9675, 9676, 443, 80)
| where InitiatingProcessFileName in~ ("LANDesk.ManagementSuite.exe", "LDDiscovery.exe", "EPMAgent.exe", "cba8.exe")
    or RemoteUrl has_any ("landesk", "ivanti", "epm", "ldms")
| join kind=leftouter EPMHosts on DeviceId
| union (
    DeviceLogonEvents
    | where LogonType in ("Network", "RemoteInteractive")
    | where AccountName !in~ ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
    | where InitiatingProcessFileName has_any ("LANDesk", "ivanti", "EPM")
    | where ActionType == "LogonSuccess"
    | where isempty(LogonResult) or LogonResult == "Success"
)
| union (
    SecurityEvent
    | where EventID in (4624, 4625, 4648)
    | where ProcessName has_any ("landesk", "ivanti", "epm", "ldms", "LANDesk.ManagementSuite")
    | where LogonType == 3
)
| union (
    AuditLogs
    | where OperationName has_any ("Logon", "Authentication", "Token")
    | where ResultReason has_any ("bypass", "unauthenticated", "anonymous")
)
| extend SuspiciousAuthentication = case(
    AccountName == "" or AccountName == "anonymous", "EmptyOrAnonymousAccount",
    isempty(AccountDomain) and LogonType == "Network", "MissingDomainNetworkLogon",
    "NominalAuthentication"
)
| where SuspiciousAuthentication != "NominalAuthentication"
| project TimeGenerated, DeviceName, AccountName, AccountDomain, RemoteIP, RemotePort, SuspiciousAuthentication, InitiatingProcessFileName
| order by TimeGenerated desc

index=windows OR index=network sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Security", "stream:tcp", "ivanti:epm")
| eval is_epm_process=if(match(lower(process_name), "landesk|ivanti|epmag|cba8|ldiscov"), 1, 0)
| eval is_epm_port=if(dest_port IN ("9675", "9676", "443", "80") AND is_epm_process=1, 1, 0)
| eval bypass_indicator=case(
    EventCode IN ("4624", "4648") AND LogonType="3" AND Account_Name="" , "empty_account_network_logon",
    EventCode="4624" AND LogonType="3" AND match(lower(Account_Name), "anonymous|guest"), "anonymous_logon",
    EventCode="4625" AND match(lower(Failure_Reason), "bypass|token|unauthenticated"), "auth_bypass_failure",
    EventCode="4648" AND is_epm_process=1 AND match(lower(Account_Name), "anonymous|guest|null"), "explicit_credential_bypass",
    true(), "nominal"
  )
| where bypass_indicator!="nominal"
| eval src_ip=coalesce(src_ip, IpAddress, SourceAddress)
| eval dest_ip=coalesce(dest_ip, DestAddress)
| stats count AS event_count, values(bypass_indicator) AS bypass_indicators, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, dest_ip, Account_Name, process_name, host
| where event_count >= 1
| eval risk_score=case(
    match(bypass_indicators, "empty_account|anonymous"), 90,
    match(bypass_indicators, "auth_bypass_failure"), 75,
    true(), 60
  )
| sort - risk_score
| table first_seen, last_seen, host, src_ip, dest_ip, Account_Name, process_name, bypass_indicators, event_count, risk_score

sequence by host.name with maxspan=5m
  [network where process.name like~ "*landesk*" or process.name like~ "*ivanti*" or process.name like~ "*epm*" or process.name like~ "*cba8*"
    and destination.port in (9675, 9676, 443, 80)
  ]
  [authentication where
    (user.name == "" or user.name like~ "*anonymous*" or user.name like~ "*guest*")
    and event.outcome == "success"
    and network.type == "ipv4"
  ]
| head 200

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  QIDNAME(qid) AS event_name,
  category,
  logsourcename(logsourceid) AS log_source,
  "Outcome" AS auth_outcome,
  LONG("EventID") AS windows_event_id
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Ivanti Endpoint Manager')
  AND (
    ("EventID" IN ('4624', '4648') AND "LogonType" = '3'
      AND (username = '' OR LOWER(username) IN ('anonymous logon', 'guest', 'anonymous')))
    OR
    ("EventID" = '4625'
      AND LOWER("FailureReason") ILIKE '%bypass%')
    OR
    (LOGSOURCETYPENAME(devicetype) = 'Ivanti Endpoint Manager'
      AND LOWER("Outcome") ILIKE '%unauthenticated%')
  )
  AND (
    LOWER(applicationname) ILIKE '%landesk%'
    OR LOWER(applicationname) ILIKE '%ivanti%'
    OR LOWER(applicationname) ILIKE '%epm%'
    OR destinationport IN (9675, 9676)
  )
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=windows/security OR _sourceCategory=ivanti/epm OR _sourceCategory=network/flows
| parse "EventID=*" as event_id nodrop
| parse "LogonType=*" as logon_type nodrop
| parse "AccountName=*" as account_name nodrop
| parse "FailureReason=*" as failure_reason nodrop
| parse "ProcessName=*" as process_name nodrop
| parse "SourceAddress=*" as src_ip nodrop
| parse "DestPort=*" as dest_port nodrop
| where (
    (event_id in ("4624", "4648") and logon_type = "3"
      and (isNull(account_name) or account_name = "" or toLowerCase(account_name) in ("anonymous logon", "guest", "anonymous")))
    or
    (event_id = "4625" and toLowerCase(failure_reason) matches "*bypass*")
    or
    (toLowerCase(_sourceCategory) matches "*ivanti*" and toLowerCase(failure_reason) matches "*unauthenticated*")
  )
| where (
    toLowerCase(process_name) matches "*landesk*"
    or toLowerCase(process_name) matches "*ivanti*"
    or toLowerCase(process_name) matches "*epm*"
    or dest_port in ("9675", "9676")
  )
| eval risk = if(account_name = "" or toLowerCase(account_name) = "anonymous logon", "HIGH", "MEDIUM")
| count by src_ip, account_name, process_name, event_id, risk
| sort by _count desc

rule ivanti_epm_auth_bypass_cve_2026_1603 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-1603 Ivanti EPM authentication bypass"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-1603"
    mitre_attack = "T1190, T1078, T1210"

  events:
    (
      $auth.metadata.event_type = "USER_LOGIN"
      and (
        $auth.target.user.user_display_name = ""
        or re.regex($auth.target.user.user_display_name, `(?i)anonymous|guest`)
      )
      and (
        re.regex($auth.target.application, `(?i)landesk|ivanti|epm|ldms`)
        or $auth.target.port in (9675, 9676)
      )
    )
    or
    (
      $auth.metadata.event_type = "USER_LOGIN"
      and $auth.metadata.product_name = "Ivanti EPM"
      and $auth.security_result.action = "ALLOW"
      and $auth.network.http.response_code != 0
    )

  condition:
    $auth
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "UserLogon", "UserLogonFailed")
| $falcon.metadata.eventType = "NetworkConnectIP4" OR $falcon.metadata.eventType = "UserLogon"

NetworkConnectIP4
| RemotePort IN (9675, 9676)
  OR (ImageFileName IMATCH "landesk|ivanti|epm|cba8|lddiscovery")
| rename RemoteAddressIP4 AS target_ip, LocalAddressIP4 AS src_ip
| join type=inner [
    UserLogon
    | UserName = "" OR UserName IMATCH "anonymous|guest"
    | AuthenticationPackage != "Kerberos"
    | LogonType IN (3, 10)
    | fields ComputerName, UserName, UserSid, RemoteAddressIP4, LogonType, AuthenticationPackage
  ] on ComputerName
| eval bypass_type = case(
    UserName = "", "empty_username_logon",
    UserName IMATCH "anonymous", "anonymous_logon",
    UserName IMATCH "guest", "guest_logon",
    true(), "other_suspicious"
  )
| stats count() AS event_count, values(bypass_type) AS bypass_types, min(timestamp) AS first_seen, max(timestamp) AS last_seen
    BY ComputerName, src_ip, target_ip, UserName, ImageFileName
| where event_count >= 1
| sort - event_count