APT actors exploit Ivanti EPMM zero-day since April
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
APT actors exploited Ivanti EPMM authentication bypass CVE-2023-35078 as zero-day from April through July 2023 to target Norwegian government and organizations.
APT actors exploited CVE-2023-35078, a critical authentication bypass in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core), as a zero-day from at least April 2023 through July 2023. The vulnerability allows unauthenticated access to specific API paths, enabling attackers to retrieve personally identifiable information (PII), make configuration changes, push packages to mobile endpoints, and access GPS data. Ivanti released a patch on July 23, 2023. The actors later chained this with CVE-2023-35081, a directory traversal flaw enabling arbitrary file write with EPMM web server privileges, to upload and execute webshells. Ivanti patched CVE-2023-35081 on July 28, 2023.
NCCS-NO investigation revealed the APT actors routed traffic through compromised ASUS routers, performed LDAP queries against Active Directory, enumerated users and administrators, accessed audit logs, and tunneled traffic through Ivanti Sentry appliances to reach internal Exchange servers. The actors deployed webshells at OWA logon/logoff paths and deleted Apache httpd log entries using a malicious Tomcat application called mi.war. Mobile device management systems are high-value targets providing elevated access to thousands of mobile devices. CISA added both CVEs to its Known Exploited Vulnerabilities Catalog in late July 2023.
Mentioned in this report
Detection guidance
Unauthenticated Access to Ivanti EPMM Core API Paths
Detects successful requests to the EPMM /mifs/aad/api/v2/ API paths that are reachable without authentication, the access pattern used to exploit CVE-2023-35078 and chained with CVE-2023-35081. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to Ivanti EPMM Core API Paths
description: Detects successful HTTP requests to the Ivanti EPMM (MobileIron Core)
/mifs/aad/api/v2/ API paths, which CVE-2023-35078 exposed without authentication
for PII retrieval and configuration changes. Review the source address; requests
from outside admin or management ranges are suspicious. Unpatched servers are the
target.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /mifs/aad/api/v2/
sc-status: 200
condition: selection
falsepositives:
- Legitimate EPMM administrators or integrations calling these API paths from known
management hosts
- Authorised vulnerability scanners testing for CVE-2023-35078
level: high
id: 704f87c2-0517-53e8-8630-c729c099252b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
Java Tomcat Process Spawning Shell for Recon or LDAP Enumeration
Detects a Java (Tomcat) process on a Linux appliance spawning a shell that runs discovery, LDAP query or download commands, consistent with webshell activity on EPMM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Tomcat Process Spawning Shell for Recon or LDAP Enumeration
description: Detects a Java parent process (such as Tomcat hosting EPMM) spawning
sh or bash with discovery, LDAP enumeration or download commands. This is typical
of webshell use after exploitation of CVE-2023-35078 and CVE-2023-35081, including
AD user and admin enumeration from the appliance.
tags:
- attack.persistence
- attack.t1505.003
- attack.discovery
- attack.t1087.002
- attack.t1018
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
Image|endswith:
- /sh
- /bash
selection_cmd:
CommandLine|contains:
- ldapsearch
- whoami
- /etc/passwd
- uname -a
- ifconfig
- 'curl '
- 'wget '
condition: selection_parent and selection_cmd
falsepositives:
- Vendor maintenance or health-check scripts launched from the Java application
- Administrators running diagnostic scripts through the application console
level: medium
id: ddd61c24-d6b7-56a2-92f0-39aa7bafbb21
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
WAR File Written to Tomcat Webapps Directory by Non-Package Process
Detects creation of .war files in a Tomcat webapps directory by anything other than package managers, as when a malicious application such as mi.war is deployed to tamper with logs or host a webshell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WAR File Written to Tomcat Webapps Directory by Non-Package Process
description: Detects a .war archive written under a webapps directory on a Linux server
outside package-manager activity. Attackers who exploited Ivanti EPMM deployed a
malicious Tomcat application (mi.war) that removed Apache httpd log entries. This
rule matches the deployment pattern rather than the file name.
tags:
- attack.persistence
- attack.t1505.003
- attack.stealth
- attack.t1070
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: /webapps/
TargetFilename|endswith: .war
filter_pkg:
Image|endswith:
- /rpm
- /dpkg
- /yum
- /dnf
- /apt
condition: selection and not filter_pkg
falsepositives:
- Planned application deployments or EPMM upgrades performed by administrators
- Configuration management tooling that deploys WAR files
level: medium
id: 8af54404-d879-5e42-9307-0d3507bead78
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs