CVE-2023-35082: Ivanti EPMM Exploitation — Detection and Hardening Guide

---
title: Potential Exploitation of Ivanti EPMM API Endpoint
id: 4a5b6c7d-8e9f-0123-4567-89abcdef0123
status: experimental
description: Detects potential exploitation attempts against Ivanti EPMM (CVE-2023-35082) via requests to the /mifs/ administrative path on port 443.
references:
  - https://forums.ivanti.com/s/article/KB-Endpoint-Manager-Mobile-EPMM-Security-Advisory-for-CVE-2023-35082
author: Security Arsenal
date: 2023/09/25
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs_uri_stem|contains: '/mifs/'
    cs_method: 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative API usage (verify source IP)
level: critical
---
title: Linux Webshell Spawned by Java Parent Process
id: 1a2b3c4d-5e6f-7890-1234-567890abcdef
status: experimental
description: Detects suspicious shell processes spawned by the Java/Tomcat service typical of Ivanti EPMM appliances, indicating potential RCE.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2023/09/25
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/java'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/perl'
      - '/python'
  condition: selection
falsepositives:
  - Legitimate administrative scripting by support staff
level: high

// Hunt for vulnerable endpoint access in Syslog/CEF
Syslog
| where Facility in ('Proxy', 'Firewall')
| extend Msg = parse_syslog(Message)
| project TimeGenerated, DeviceName, SourceIP, Msg
| where Msg has_any ('/mifs/', 'ivanti')
| where Msg has 'POST'
| extend Uri = extract(@'cs_uri_stem=([^\s]+)', 1, Msg)
| where Uri contains '/mifs/'
| summarize Count = count() by TimeGenerated, SourceIP, DeviceName, Uri
| order by TimeGenerated desc


// Hunt for Java spawning shell on Linux (if auditd is ingested)
imProcessCreate
| where ActingProcessFileName endswith 'java'
| where ProcessFileName has_any ('sh', 'bash', 'nc', 'perl', 'python')
| project TimeGenerated, Hostname, ActingProcessFileName, ProcessFileName, CommandLine
| order by TimeGenerated desc

-- Hunt for suspicious child processes of Java/Tomcat
SELECT Pid, Name, CommandLine, Exe, Username, Ppid
FROM pslist()
WHERE Ppid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ 'java'
      AND Exe =~ '/opt/iron' 
)
  AND Name =~ '(sh|bash|perl|python|nc|wget|curl)'

-- Hunt for recently modified files in web directories (Webshell detection)
SELECT FullPath, Size, Mtime, Mode, IsDir
FROM glob(globs='/**/*')
WHERE Mtime > now() - 7d 
  AND (FullPath =~ '/mifs/' OR FullPath =~ '/tomcat/webapps/')
  AND NOT IsDir
  AND (Size < 50000 AND Mtime != Atime) 
  AND FullName =~ '(.jsp|.jspx|.php|.sh)'

#!/bin/bash

# Check Ivanti EPMM Version for CVE-2023-35082

echo "Checking Ivanti EPMM version..."

# RPM check for older installs or command line version check
if command -v rpm &> /dev/null; then
    VERSION=$(rpm -q --queryformat '%{VERSION}' ivanti-epmm 2>/dev/null || rpm -q --queryformat '%{VERSION}' mobileiron-core 2>/dev/null)
    echo "Current installed version: $VERSION"
else
    # Attempt to get version from configuration files or binary
    VERSION=$(cat /etc/mi/mi_config 2>/dev/null | grep VERSION | cut -d'=' -f2)
    echo "Detected version from config: $VERSION"
fi

# Define vulnerable ranges logic (simplified for guidance)
if [[ -n "$VERSION" ]]; then
    echo "Comparing against vulnerable ranges..."
    echo "Vulnerable: All versions below 11.10.0.2, 11.9.1.2, and 11.8.x and lower."
    echo "Please verify manually against Ivanti Security Advisory."
    echo "URL: https://forums.ivanti.com/s/article/KB-Endpoint-Manager-Mobile-EPMM-Security-Advisory-for-CVE-2023-35082"
else
    echo "Could not determine version automatically. Please check via Admin Console."
fi

# Check for recent suspicious modifications in webroot
echo "Checking for recently modified files in /mifs/ (potential webshells)..."
find /mifs/ -type f -mtime -1 -ls 2>/dev/null