Ivanti EPMM Exploitation Attempt via URI Parameters
This query identifies HTTP(S) requests logged within Ivanti EPMM (formerly MobileIron) logs that match exploitation URI parameters, specifically looking for '/mifs/c/appstore/fob' and '=gPath' in the HTTP_Request_URI. The EPMM Version number is also extracted to provide additional context for security teams to identify if their software version is vulnerable.
Cortex XDR
