Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
3
Contributors
3
2
1
Categories
4
2
2
1
1
Platforms
4
2
Products / Services
2
1
1
1
1
MITRE Techniques
4
2
2
2
2
CVEs
71
71
64
58
49
This rule detects outbound network connections from Ivanti EPMM appliances to known Out-of-Band (OOB) interaction services and tunneling platforms. This activity is often associated with automated reconnaissance and exploitation verification for vulnerabilities like CVE-2026-1281.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
This rule detects the creation of specific JSP web shell filenames (1.jsp, 401.jsp, 403.jsp) and suspicious CSS files in the Ivanti EPMM web application directory. This activity is indicative of post-exploitation persistence following the exploitation of vulnerabilities like CVE-2026-1281 or CVE-2026-1340.
Detects the creation of JSP web shells or suspicious CSS files in the specific directory used by Ivanti EPMM for application distribution, a common post-exploitation step observed in this campaign.
Detects suspicious child processes (e.g., shells, network utilities) spawned by the Ivanti EPMM web server process (java, tomcat, httpd). This behavior is a strong indicator of successful remote code execution, often following the exploitation of vulnerabilities like CVE-2026-1281 and CVE-2026-1340.
Detects HTTP GET requests to Ivanti EPMM endpoints containing the 'gPath' parameter, which is indicative of exploitation attempts against CVE-2026-1281 and CVE-2026-1340.