Detecting Ivanti Connect Secure Exploitation

In January 2024, attackers chained CVE-2023-46805, an authentication bypass in the web component, with CVE-2024-21887, a command injection flaw, to run commands on Ivanti Connect Secure appliances before any patch existed (T1190). Public reporting described modified legitimate CGI files and web shell-like implants, along with attempts to defeat the vendor’s integrity checker. Detection therefore combines the request pattern, external integrity checks and appliance behaviour.

Signals at a Glance

Request Patterns

Public analyses describe the chain being reached through a path-traversal sequence under the TOTP backup-code API, followed by calls to system or maintenance endpoints. If you retain request URIs, search for traversal under that prefix. A Suricata rule on decrypted traffic, or a WAF in front of the appliance, can catch the same shape:

alert http $EXTERNAL_NET any -> $HOME_NET any (
  msg:"HUNT Ivanti Connect Secure path traversal under totp user-backup-code";
  flow:established,to_server;
  http.uri; content:"/api/v1/totp/user-backup-code/"; startswith;
  content:"../"; distance:0;
  classtype:web-application-attack; sid:1000801; rev:1;
)
# Tune/validate: requires decrypted traffic (WAF or TLS inspection).
# Encoded variants (%2e%2e%2f) should be normalised before matching.

The same logic works against web logs in Sigma form, which is helpful when appliance logs are forwarded as webserver events:

title: Ivanti Connect Secure Traversal Under TOTP Backup Code API
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains|all:
      - 'user-backup-code'
    cs-uri-stem|contains:
      - '/api/v1/totp/user-backup-code/'
  traversal:
    cs-uri-stem|contains:
      - '../'
      - '%2e%2e'
  condition: selection and traversal
level: high
# Tune/validate: the exact field holding the full path varies by log source.

Integrity Checks and Appliance Behaviour

• Run Ivanti’s Integrity Checker Tool on a schedule and after every advisory. Prefer the external version that runs against a snapshot, because compromised appliances have been reported to tamper with their own internal checks.
• Keep the checker output. A changed file list is a time-stamped baseline for scoping, even if the appliance is later reset.
• Alert on logging anomalies: a drop in event volume, a log file that resets, or a device that stops forwarding syslog.
• Watch for outbound connections from the appliance to hosts it has never contacted, and for internal scanning or authentication attempts from its address.
• If compromise is confirmed, follow the vendor’s factory-reset and rebuild guidance, rotate all credentials and certificates that resided on the device, and review every account that authenticated through it.