CVE-2026-6973: Ivanti EPMM Improper Input Validation Exploitation

union isfuzzy=true
(
  CommonSecurityLog
  | where DeviceVendor == "Ivanti" or DeviceProduct has_any ("EPMM", "MobileIron")
  | where RequestURL has_any ("/mifs/", "/api/v1/", "/api/v2/", "/admin/")
  | where Activity has_any ("400", "422", "500") or AdditionalExtensions has "malformed"
  | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestURL, Activity, AdditionalExtensions
),
(
  W3CIISLog
  | where csUriStem has_any ("/mifs/", "/api/v1/", "/api/v2/")
  | where scStatus in ("400", "422", "500") or csUriQuery matches regex @"[\x00-\x1f%00-%1f]"
  | project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, csUserAgent
),
(
  AzureDiagnostics
  | where ResourceType == "APPLICATIONGATEWAYS"
  | where requestUri_s has_any ("/mifs/", "/api/v1/", "/api/v2/")
  | where httpStatus_d in (400, 422, 500)
  | project TimeGenerated, clientIP_s, requestUri_s, httpStatus_d, userAgent_s
)
| extend AccountCustomEntity = iff(isnotempty(SourceIP), SourceIP, cIP)
| extend IPCustomEntity = iff(isnotempty(SourceIP), SourceIP, cIP)

index=proxy OR index=webserver OR index=ivanti
(sourcetype="ivanti:epmm" OR sourcetype="iis" OR sourcetype="cisco:proxy" OR sourcetype="pan:traffic")
(
  (uri_path IN ("/mifs/*", "/api/v1/*", "/api/v2/*", "/admin/*"))
  OR (dest_app="EPMM" OR dest_app="MobileIron")
)
(
  status IN ("400", "422", "500") 
  OR uri_query IN ("*%00*", "*%0a*", "*%0d*", "*\\x00*")
  OR bytes_in > 1000000
)
| eval exploit_indicator=case(
    match(uri_query, "(?i)(%00|%0a|%0d|\\x00|\\n|\\r)"), "null_or_crlf_injection",
    status IN ("400", "422"), "input_validation_error",
    bytes_in > 1000000, "oversized_request",
    true(), "anomalous_request"
  )
| stats count as request_count, values(uri_path) as paths, values(status) as statuses, values(exploit_indicator) as indicators by src_ip, dest, _time span=5m
| where request_count > 3
| sort -request_count

sequence by source.ip with maxspan=10m
  [network where event.category == "network" and
   url.path : ("/mifs/*", "/api/v1/*", "/api/v2/*", "/admin/*") and
   http.response.status_code in (400, 422, 500)]
  [network where event.category == "network" and
   url.path : ("/mifs/*", "/api/v1/*", "/api/v2/*", "/admin/*") and
   (
     http.response.status_code in (200, 201, 204) or
     http.request.body.bytes > 100000
   )]

SELECT
  sourceip,
  destinationip,
  URL,
  "responseCode",
  QIDNAME(qid) as event_name,
  COUNT(*) as event_count,
  MIN(starttime) as first_seen,
  MAX(starttime) as last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Ivanti EPMM', 'Microsoft IIS', 'Apache HTTP Server')
  AND (
    URL ILIKE '%/mifs/%'
    OR URL ILIKE '%/api/v1/%'
    OR URL ILIKE '%/api/v2/%'
    OR URL ILIKE '%/admin/%'
  )
  AND (
    "responseCode" IN ('400', '422', '500')
    OR URL ILIKE '%\%00%'
    OR URL ILIKE '%\%0a%'
    OR URL ILIKE '%\%0d%'
  )
  AND LOGSOURCENAME(logsourceid) ILIKE '%EPMM%'
  AND starttime > NOW() - 3600000
GROUP BY sourceip, destinationip, URL, "responseCode"
HAVING event_count > 5
ORDER BY event_count DESC
LAST 60 MINUTES

_sourceCategory=ivanti/epmm OR _sourceCategory=webserver/iis
| where (%"url" matches "/mifs/*" or %"url" matches "/api/v1/*" or %"url" matches "/api/v2/*" or %"url" matches "/admin/*")
| where (%"status" in ("400", "422", "500") or %"url" matches "*%00*" or %"url" matches "*%0a*")
| timeslice 5m
| count by _timeslice, %"src_ip", %"url", %"status"
| where _count > 3
| sort by _count desc
| fields _timeslice, %"src_ip", %"url", %"status", _count

rule cve_2026_6973_ivanti_epmm_exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation attempts against Ivanti EPMM CVE-2026-6973"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-6973"

  events:
    $request.metadata.event_type = "NETWORK_HTTP"
    $request.principal.ip = $src_ip
    (
      $request.target.url.path = /\/mifs\// or
      $request.target.url.path = /\/api\/v[12]\// or
      $request.target.url.path = /\/admin\//
    )
    (
      $request.network.http.response_code = 400 or
      $request.network.http.response_code = 422 or
      $request.network.http.response_code = 500 or
      $request.target.url.query = /%00/ or
      $request.target.url.query = /%0[aAdD]/
    )

  match:
    $src_ip over 5m

  condition:
    #request > 5
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "HttpRequest")
| RemotePort = 443 OR RemotePort = 8443 OR RemotePort = 80
| (RemoteAddressIP4 != null OR RemoteAddressIP6 != null)
| HttpPath IN ("/mifs/", "/api/v1/", "/api/v2/", "/admin/")
   OR HttpPath = /\/mifs\/.*/ 
   OR HttpPath = /\/api\/v[12]\/.*/
| (HttpStatus IN (400, 422, 500) OR HttpQueryString = /(%00|%0a|%0d)/i)
| groupBy([RemoteAddressIP4, RemoteAddressIP6, HttpPath, HttpStatus], function=[count(aid, as=RequestCount), min(timestamp, as=FirstSeen), max(timestamp, as=LastSeen)])
| RequestCount > 3
| sort(RequestCount, order=desc)