Ivanti EPMM RCE Vulnerability Chain (CVE-2025-4427, CVE-2025-4428) and Sleeper Shells
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts: 1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts. 2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Microsoft Sentinel (KQL)
