Ivanti Connect Secure: Hunt & Detect

2026.03.15 SUBJECT: EDGE_SECURITY KQL_Hunting

Strategic Briefing

The Ivanti Connect Secure (ICS) vulnerabilities—specifically the devastating chain of CVE-2023-46805 (Authentication Bypass) and CVE-2024-21887 (Command Injection)—have reshaped perimeter security assumptions. Attackers realized that edge gateways, traditionally trusted appliances sitting at the boundary of the internal network, often lack deep Endpoint Detection and Response (EDR) coverage. By chaining an auth bypass with a crafted payload sent to the `/api/v1/totp/user-backup-code` endpoint, adversaries gained unauthenticated, root-level remote command execution. This briefing translates these exploit mechanics into high-fidelity KQL hunting queries for Microsoft Sentinel, shifting the focus from patching to proactive detection of post-exploitation behavior.

0x01: Web Request Anomaly Detection

Before a web shell is dropped, adversaries must probe the gateway to confirm exploitability. While signatures for specific payloads often change, the targeted URIs remain relatively static. By analyzing the `CommonSecurityLog` in Sentinel, we can hunt for anomalous, high-frequency requests hitting the specific vulnerable API paths, regardless of the obfuscation used in the payload body.

IVANTI_PATH_ANOMALY.KQL
// Hunt for Exploit Probing against Ivanti ICS Gateways CommonSecurityLog | where TimeGenerated >= ago(7d) | where DeviceVendor =~ "Ivanti" // Target paths known for auth bypass and command injection | where RequestURL has_any ("/api/v1/totp/user-backup-code", "/api/v1/configuration/users/user-roles", "/api/v1/system/maintenance/archiving/cloud-server-test-connection") | summarize RequestCount=count(), DistinctPaths=dcount(RequestURL) by bin(TimeGenerated, 1h), SourceIP, DestinationIP | where RequestCount > 5 // Threshold for probing activity | project TimeGenerated, SourceIP, DestinationIP, RequestCount, DistinctPaths | sort by RequestCount desc

0x02: Lateral Movement Hunt

The true danger of an edge gateway compromise is what happens next. ICS appliances are not the final target; they are the beachhead. Once a foothold is established, threat actors immediately attempt to pivot internally (East-West traffic) to reach Tier-0 assets like Domain Controllers. Because the gateway is a trusted internal node, this traffic often bypasses perimeter firewalls. By correlating `DeviceNetworkEvents`, we hunt for the appliance behaving out of character—initiating SMB, RDP, or WinRM connections to internal infrastructure.

IVANTI_LATERAL_MVMNT.KQL
// Detect unusual lateral movement originating from the Ivanti Gateway IP let IvantiGatewayIPs = dynamic(["10.0.0.5", "10.0.0.6"]); // Replace with actual gateway IPs DeviceNetworkEvents | where TimeGenerated >= ago(24h) | where RemoteIP in (IvantiGatewayIPs) // Focus on typical lateral movement ports | where RemotePort in (445, 135, 5985, 5986, 3389) | where ActionType == "ConnectionSuccess" | summarize ConnectionCount=count(), TargetDevices=make_set(DeviceName) by bin(TimeGenerated, 1h), RemoteIP, RemotePort, LocalIP | project TimeGenerated, SourceGateway=RemoteIP, TargetIP=LocalIP, Port=RemotePort, TargetDevices, ConnectionCount | sort by TimeGenerated desc