Detect Ivanti Endpoint Manager (EPM) Authentication Bypass (CVE-2026-1603) in CrowdStrike LogScale
CVE-2026-1603 is an authentication bypass vulnerability (CWE-288) in Ivanti Endpoint Manager (EPM). This KEV-listed vulnerability allows unauthenticated attackers to bypass authentication mechanisms and gain unauthorized access to the EPM management interface. Successful exploitation may lead to full compromise of managed endpoints, lateral movement, and deployment of malicious software across the enterprise.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "UserLogon", "UserLogonFailed")
| $falcon.metadata.eventType = "NetworkConnectIP4" OR $falcon.metadata.eventType = "UserLogon"
NetworkConnectIP4
| RemotePort IN (9675, 9676)
OR (ImageFileName IMATCH "landesk|ivanti|epm|cba8|lddiscovery")
| rename RemoteAddressIP4 AS target_ip, LocalAddressIP4 AS src_ip
| join type=inner [
UserLogon
| UserName = "" OR UserName IMATCH "anonymous|guest"
| AuthenticationPackage != "Kerberos"
| LogonType IN (3, 10)
| fields ComputerName, UserName, UserSid, RemoteAddressIP4, LogonType, AuthenticationPackage
] on ComputerName
| eval bypass_type = case(
UserName = "", "empty_username_logon",
UserName IMATCH "anonymous", "anonymous_logon",
UserName IMATCH "guest", "guest_logon",
true(), "other_suspicious"
)
| stats count() AS event_count, values(bypass_type) AS bypass_types, min(timestamp) AS first_seen, max(timestamp) AS last_seen
BY ComputerName, src_ip, target_ip, UserName, ImageFileName
| where event_count >= 1
| sort - event_countCrowdStrike Falcon LogScale (CQL) query correlating network connections to Ivanti EPM ports and processes with anomalous user logon events featuring empty, anonymous, or guest usernames, indicating potential CVE-2026-1603 authentication bypass exploitation.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike sensor telemetry gaps where username fields are not populated during certain logon types
- Authorized EPM agents or service accounts using non-Kerberos authentication methods in legacy environments
- Vulnerability scanning or penetration testing tools exercising EPM authentication endpoints with authorized credentials
- EPM agent provisioning workflows that temporarily authenticate with reduced or empty credentials during initial enrollment
Other platforms for CVE-2026-1603
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Anonymous Network Logon to EPM Port
Expected signal: Windows Security EventID 4624 with LogonType=3 and AccountName blank or 'ANONYMOUS LOGON' on the EPM server; IIS access log entry with 401/200 status for /ldlogon/ from test source IP; network flow record on EPM management port 9675.
- Test 2EPM Process Spawning Suspicious Child Process
Expected signal: DeviceProcessEvents entry showing cmd.exe spawned with working directory in Ivanti Management Suite path; process creation event with parent process in EPM directory; command line containing 'whoami' captured in endpoint telemetry.
- Test 3Authentication Bypass Simulation via Empty Credential HTTP Request
Expected signal: IIS access log entry on EPM server showing request to /ldlogon/ with empty Authorization header from test IP; network flow record; if EPM processes the request, a Windows Security EventID 4624 or 4648 with minimal credential context.
Response Playbook
Triage
- Identify the Ivanti EPM server(s) in scope — cross-reference asset inventory for all hosts running EPM 2024 or earlier versions listed in the advisory. Confirm patch status against Ivanti's February 2026 security bulletin.
- Review EPM server authentication logs (IIS logs, EPM application logs, Windows Security Event Log EventID 4624/4648) for logon events with empty, null, or anonymous account names originating from external or untrusted IP ranges within the past 14 days.
- Correlate suspicious EPM authentication events with subsequent activity from the same source IP — look for EPM console access, policy changes, software distribution tasks, or agent redeployments that could indicate post-auth exploitation.
- Determine whether the EPM server is internet-facing or exposed to untrusted network segments. If exposed, treat all anomalous authentication events as high-priority incidents requiring immediate containment.
Containment
- If exploitation is confirmed or strongly suspected, immediately isolate the EPM server from the network by blocking inbound traffic to EPM management ports (9675, 9676, 443, 80) at the perimeter firewall and any internal segmentation controls, and notify the security team for emergency patch deployment.
- Revoke or rotate all EPM administrative credentials and service account passwords, and audit all EPM agent certificates or tokens that may have been issued or modified during the suspected exploitation window. Suspend EPM-initiated software distribution tasks until the server integrity is verified.
Evidence Collection
- Preserve EPM server IIS access logs, EPM application event logs, and Windows Security Event Logs (EventIDs 4624, 4625, 4648, 4672, 4769) from the suspected exploitation window. Archive to read-only storage before any remediation actions are taken.
- Collect a memory image and disk forensic copy of the EPM server if active compromise is suspected, capturing running processes, network connections (netstat output), scheduled tasks, and any newly created or modified files in EPM installation directories (typically C:\Program Files\LANDesk\ManagementSuite\ or C:\Program Files\Ivanti\).
Escalation Criteria
- !Escalate to incident response team if post-authentication activity is detected, including EPM policy modifications, mass software deployment to managed endpoints, creation of new EPM administrative accounts, or lateral movement from the EPM server to other hosts.
- !Escalate immediately if the EPM server is confirmed as unpatched and authentication bypass evidence exists, as successful exploitation of an EPM server can result in remote code execution on all managed endpoints — a potential enterprise-wide compromise scenario.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS access logs on the EPM server showing unauthenticated or anonymously authenticated requests to EPM API endpoints (typically under /ldlogon/, /ldms/, or /ManagementSuite/) - >
Windows Security Event Log entries on the EPM server with EventID 4624 (successful logon), LogonType 3 (network), and blank or anonymous AccountName fields originating from unexpected source IPs - >
EPM application database (SQL Server) audit entries showing configuration changes, new administrative account creation, or bulk software distribution tasks initiated without corresponding authorized change records - >
Network flow records showing connections from external or untrusted IPs to EPM management ports (9675, 9676) followed by successful HTTP 200 responses to privileged API endpoints
Tuning Guidance
Start by building an allowlist of known-good EPM service accounts, source IPs (EPM agents, admin workstations), and expected authentication times. Apply this allowlist to suppress false positives from legitimate EPM operations. Increase confidence thresholds by requiring both an anomalous authentication event AND a subsequent privileged action (policy change, software deployment) within the same session before alerting at critical severity. In environments where EPM logs are directly ingested, tune on the specific EPM log event codes for authentication bypass rather than relying solely on Windows Security events, which provide less granular EPM context.
Hunting Queries
Hunt for post-exploitation activity on EPM servers: suspicious child processes spawned by EPM binaries (KQL) and off-hours authentication to EPM servers from unusual source IPs (SPL), which may indicate attacker persistence or lateral movement after authentication bypass.
DeviceProcessEvents
| where DeviceName in~ (toscalar(DeviceNetworkEvents
| where RemotePort in (9675, 9676)
| summarize make_set(DeviceName)))
| where InitiatingProcessFileName has_any ("LANDesk", "ivanti", "EPM", "cba8", "ldiscov")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "certutil.exe")
| where ProcessCommandLine has_any ("download", "invoke", "iex", "webclient", "base64", "bypass", "encoded")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by TimeGenerated descindex=windows sourcetype="WinEventLog:Security" EventCode IN (4624, 4648)
| eval is_epm_server=[| inputlookup epm_servers.csv | return $host]
| where host IN (is_epm_server)
| eval logon_hour=strftime(_time, "%H")
| where (logon_hour < 6 OR logon_hour > 22)
| stats count AS off_hours_logons, values(src_ip) AS source_ips, values(Account_Name) AS accounts BY host, logon_hour
| where off_hours_logons >= 3
| sort - off_hours_logonsAtomic Red Team Tests
Simulates the network-level authentication bypass by attempting an unauthenticated HTTP request to the Ivanti EPM management interface, generating the Windows Security Event Log entries that the detection rules target.
Command
Invoke-WebRequest -Uri 'http://<EPM_SERVER_IP>:9675/ldlogon/' -Method GET -UseBasicParsing -TimeoutSec 10 | Select-Object StatusCode, Headers; Write-Host 'Check Security Event Log on EPM server for EventID 4624 with empty AccountName'Cleanup
No persistent changes; review IIS and Security event logs on EPM server and clear test entries from SIEM if needed.Expected Telemetry
Windows Security EventID 4624 with LogonType=3 and AccountName blank or 'ANONYMOUS LOGON' on the EPM server; IIS access log entry with 401/200 status for /ldlogon/ from test source IP; network flow record on EPM management port 9675.
Expected Detection
KQL and SPL queries should trigger on the empty AccountName + LogonType 3 + EPM process correlation; Chronicle YARAL rule should fire on the USER_LOGIN event with empty user display name targeting EPM application.
Simulates post-exploitation behavior where an attacker who bypassed EPM authentication uses it to execute commands, generating process telemetry that hunting queries target.
Command
Start-Process -FilePath 'C:\Windows\System32\cmd.exe' -ArgumentList '/c whoami > C:\Temp\epm_test_output.txt' -WorkingDirectory 'C:\Program Files\Ivanti\Management Suite\' 2>$null; Start-Sleep -Seconds 2; Get-Content 'C:\Temp\epm_test_output.txt'Cleanup
Remove-Item 'C:\Temp\epm_test_output.txt' -Force -ErrorAction SilentlyContinueExpected Telemetry
DeviceProcessEvents entry showing cmd.exe spawned with working directory in Ivanti Management Suite path; process creation event with parent process in EPM directory; command line containing 'whoami' captured in endpoint telemetry.
Expected Detection
KQL hunting query should detect cmd.exe spawned from EPM installation directory path; CrowdStrike CQL query should correlate the network connection to EPM ports with the subsequent process creation event.
Tests detection coverage for authentication bypass by sending HTTP requests with empty or null Authorization headers to EPM API endpoints, mimicking the CWE-288 bypass pattern.
Command
curl -v -X GET 'http://<EPM_SERVER_IP>:9675/ldlogon/ldappl3.manifest.0' -H 'Authorization: ' -H 'X-LanDesk-Client: test' --max-time 10 2>&1 | grep -E '(HTTP|< |> )'; echo 'Test complete — check EPM server IIS logs for anonymous access attempt'Cleanup
No persistent changes; flush relevant log entries from test SIEM environment if needed to avoid false positive noise.Expected Telemetry
IIS access log entry on EPM server showing request to /ldlogon/ with empty Authorization header from test IP; network flow record; if EPM processes the request, a Windows Security EventID 4624 or 4648 with minimal credential context.
Expected Detection
Sumo Logic and QRadar queries should detect the access attempt against EPM-specific paths; if the request succeeds (HTTP 200), all platform queries should elevate to high-confidence alert given the confirmed anonymous access to EPM resources.