Ivanti EPMM Sleeper Shell Access via 403.jsp

Ethan Andrews@eandrews

•updated Feb 10, 2026•3•0•30

This detection monitors for web requests to the specific URI path "/mifs/403.jsp". This path is known to be used by attackers to deploy a dormant Java-based webshell ("sleeper shell") on vulnerable Ivanti Endpoint Manager Mobile (EPMM) instances as part of an initial access campaign.