Ivanti EPMM RCE Exploit URI (CVE-2026-1281, CVE-2026-1340)
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
Microsoft Sentinel (KQL)
