Cisco ISE Authentication Bypass · CVE-2026-76460

Looks for: creation, update, or deletion of an ISE admin user, admin group, or RBAC permission via the admin audit log. FP: legitimate onboarding through your documented IAM/JML process.

// HUNT: New or modified Cisco ISE administrator accounts
// MITRE: T1098, T1136
// CONF: high
// FP: low
// COST: low
// REQUIRES: Cisco ISE admin/audit log ingested into Falcon NG-SIEM (NOT native sensor telemetry). LOOKBACK: 7d, set in the console time picker.
// FALSE POSITIVES: legitimate admin provisioning through your documented IAM/JML process
// ⚠ validate in tenant: field names (log_source, audit_action, audit_object, actor_user) depend on your ISE syslog parser/repo schema; confirm against a sample ingested row before deploying
#repo=ise_syslog
| log_source=/^ise-(admin|psc)\/audit\.log$/i
| audit_action=/^(CREATE|UPDATE|DELETE)$/
| audit_object=/^(AdminUser|AdminGroup|RBACPermission)$/i
| table([@timestamp, ise_node, actor_user, audit_action, audit_object, target_object, src_ip])
| sort(@timestamp, order=desc)

Looks for: the exact behavioral technique in Cisco's own advisory, generalized past the single "dummyuser" example. FP: legitimate service accounts or federated SSO usernames that don't match your normal admin/RADIUS naming convention.

// HUNT: Cisco ISE access.log: anomalous / non-standard usernames hitting the API gateway
// MITRE: T1190, T1556
// CONF: high
// FP: medium
// COST: low
// REQUIRES: Cisco ISE ise-kong/access.log ingested into Falcon NG-SIEM (NOT native sensor telemetry). LOOKBACK: 7d, set in the console time picker.
// FALSE POSITIVES: legitimate service accounts or federated SSO usernames that don't match your expected admin/RADIUS naming convention
// TUNING: exclude your organization's known service-account and SSO username patterns before promoting to an alert
// ⚠ validate in tenant: field names (user_name, uri_path, http_status) depend on your ISE syslog parser/repo schema; confirm against a sample ingested row before deploying
#repo=ise_syslog
| log_source=/^ise-kong\/access\.log$/i
| user_name=/^(dummyuser|test|guest|admin1|null|undefined)$/i
| table([@timestamp, ise_node, user_name, http_method, uri_path, http_status, src_ip])
| sort(@timestamp, order=desc)

Looks for: a successful response on an admin/ERS/config path with no authorization header present, the direct signature of the auth-bypass. FP: legitimate unauthenticated health-check or monitoring probes.

// HUNT: Unauthenticated 200-OK responses on Cisco ISE privileged API endpoints
// MITRE: T1190
// CONF: high
// FP: medium
// COST: low
// REQUIRES: Cisco ISE ise-kong/access.log (API gateway) ingested into Falcon NG-SIEM (NOT native sensor telemetry). LOOKBACK: 7d, set in the console time picker.
// FALSE POSITIVES: legitimate unauthenticated health-check/status endpoints and monitoring probes allowed by your iACL
// TUNING: exclude your documented monitoring/health-check source IPs and their expected read-only paths
// ⚠ validate in tenant: field names (auth_header_present, uri_path, http_status) depend on your ISE syslog parser/repo schema; confirm against a sample ingested row before deploying
#repo=ise_syslog
| log_source=/^ise-kong\/access\.log$/i
| uri_path=/\/(admin|api|ers|mnt|config)\//i
| auth_header_present=0
| http_status=200
| table([@timestamp, ise_node, src_ip, http_method, uri_path, http_status, user_agent])
| sort(@timestamp, order=desc)

Looks for: log rotation/clearing language or an unplanned restart of the logging/API-gateway service, the behavior Cisco's advisory warns a root-level attacker can perform. FP: scheduled log rotation and planned maintenance restarts.

// HUNT: Cisco ISE log-service restart or log-file truncation (possible anti-forensic activity)
// MITRE: T1070, T1070.002
// CONF: medium
// FP: low
// COST: low
// REQUIRES: Cisco ISE operational/system syslog ingested into Falcon NG-SIEM (NOT native sensor telemetry). LOOKBACK: 14d, set in the console time picker.
// FALSE POSITIVES: scheduled log rotation and planned application-service restarts during maintenance windows
// ⚠ validate in tenant: field names (log_source, message) depend on your ISE syslog parser/repo schema; confirm against a sample ingested row before deploying
#repo=ise_syslog
| log_source=/^ise-(kong|psc|mnt)\/(system|application)\.log$/i
| message=/(log.?(rotat|clear|purg|truncat)|service .*(restart|stop).*(apigateway|ise-kong|logging))/i
| table([@timestamp, ise_node, log_source, message])
| sort(@timestamp, order=desc)

Looks for: write-method calls (POST/PUT/PATCH/DELETE) against admin/ERS/config paths, the mechanism an attacker uses to change policy or accounts after bypassing auth. FP: normal change windows and CI/CD-driven ISE config-as-code pushes.

// HUNT: Cisco ISE API-driven configuration changes (POST/PUT/PATCH/DELETE) on admin/ERS paths
// MITRE: T1556, T1098
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: Cisco ISE ise-kong/access.log ingested into Falcon NG-SIEM (NOT native sensor telemetry). LOOKBACK: 7d, set in the console time picker.
// FALSE POSITIVES: documented change-management windows and CI/CD-driven ISE config-as-code pushes
// TUNING: exclude your known change-management source IPs/service accounts and scheduled maintenance windows
// ⚠ validate in tenant: field names (http_method, uri_path, user_name) depend on your ISE syslog parser/repo schema; confirm against a sample ingested row before deploying
#repo=ise_syslog
| log_source=/^ise-kong\/access\.log$/i
| http_method=/^(POST|PUT|PATCH|DELETE)$/
| uri_path=/\/(ers|admin|config)\//i
| table([@timestamp, ise_node, src_ip, user_name, http_method, uri_path, http_status])
| sort(@timestamp, order=desc)

Looks for: an endpoint being granted a broad/default authorization profile that should be rare, the outcome of policy tampering after ISE compromise. FP: legitimate BYOD onboarding and guest-portal enrollments.

// HUNT: Rogue endpoint granted network access via anomalous RADIUS/TACACS+ authorization from Cisco ISE
// MITRE: T1556.004, T1078
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: Cisco ISE RADIUS/TACACS+ accounting and authorization logs ingested into Falcon NG-SIEM (NOT native sensor telemetry). LOOKBACK: 7d, set in the console time picker.
// FALSE POSITIVES: legitimate BYOD onboarding, guest-portal enrollments, and planned device-provisioning rollouts
// TUNING: exclude your guest/BYOD SSID and known device-onboarding authorization profiles
// ⚠ validate in tenant: field names (authz_profile, endpoint_mac, nas_ip) depend on your ISE syslog parser/repo schema; confirm against a sample ingested row before deploying
#repo=ise_syslog
| log_source=/^ise-psc\/(radius|tacacs)-accounting\.log$/i
| authz_profile=/^(PermitAll|Unknown|DefaultAccess)$/i
| table([@timestamp, ise_node, endpoint_mac, calling_station_id, authz_profile, nas_ip, username])
| sort(@timestamp, order=desc)

Looks for: real network connections, observed on the DC's own Falcon sensor, arriving from a known ISE node IP on ports outside expected AD-integration traffic. This is genuine native Falcon endpoint telemetry, not log ingest. FP: normal, expected ISE-to-DC LDAP/Kerberos/DNS lookups, which dominate this traffic pattern and must be baselined first.

// HUNT: Inbound connections from a Cisco ISE node IP toward Falcon-protected Domain Controllers
// MITRE: T1210, T1078.002, T1021
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor installed on the Domain Controller(s). This is standard native endpoint telemetry, NOT ISE log ingest. Populate the ISE node IP for your environment. LOOKBACK: 7d, set in the console time picker.
// FALSE POSITIVES: normal, expected ISE-to-DC LDAP/Kerberos/DNS traffic for AD integration. This is the dominant pattern and must be baselined per environment before alerting
// TUNING: scope RemotePort to non-standard/administrative ports and exclude your documented ISE-AD service-account bind traffic on 389/636/88/53
#event_simpleName=/NetworkConnectIP4/
| cidr(RemoteAddressIP4, subnet=["REPLACE_WITH_ISE_NODE_IP/32"])
| RemotePort=/^(445|3389|5985|5986)$/
| table([@timestamp, ComputerName, LocalAddressIP4, RemoteAddressIP4, RemotePort, ImageFileName, CommandLine])
| sort(@timestamp, order=desc)

Looks for: a client outside the designated admin subnet reaching an ISE management/API/RADIUS/TACACS+ port, observed from the client's own Falcon sensor. FP: legitimate admin jump-hosts, RADIUS/TACACS+ NAS devices, and monitoring tools outside the primary admin VLAN; this query is noisy until fully tenant-tuned.

// HUNT: Endpoint-initiated connections to Cisco ISE management/API ports from outside the admin subnet
// MITRE: T1595, T1190
// CONF: low
// FP: high
// COST: medium
// REQUIRES: Falcon sensor on the connecting/client endpoints. This is standard native endpoint telemetry, NOT ISE log ingest. It only sees traffic FROM Falcon-covered hosts; it cannot see the ISE appliance side, and it is blind to unmanaged clients, NAS devices, and other network gear. LOOKBACK: 7d, set in the console time picker.
// FALSE POSITIVES: legitimate admin jump-hosts, RADIUS/TACACS+ NAS devices, and monitoring tools outside the primary admin VLAN
// TUNING: replace the admin-subnet CIDR below with your actual jump-host/admin VLAN ranges before promoting; without tuning this fires on all legitimate NAS/RADIUS client traffic
#event_simpleName=/NetworkConnectIP4/
| RemotePort=/^(443|8443|9060|1812|1813|49)$/
| cidr(RemoteAddressIP4, subnet=["REPLACE_WITH_ISE_NODE_IP/32"])
| !cidr(LocalAddressIP4, subnet=["REPLACE_WITH_ADMIN_SUBNET_CIDR"])
| table([@timestamp, ComputerName, LocalAddressIP4, RemoteAddressIP4, RemotePort, ImageFileName])
| sort(@timestamp, order=desc)

Looks for: the same source IP appearing in both an anomalous-username hit (Q2) and a subsequent configuration write (Q5), a host-scoped correlation to prioritize triage. FP: shared NAT/proxy egress IPs across unrelated legitimate sessions.

// HUNT: Pivot: correlate an anomalous-username hit with a later config write from the same source IP
// MITRE: T1190, T1556
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: Cisco ISE ise-kong/access.log ingested into Falcon NG-SIEM (NOT native sensor telemetry). LOOKBACK: 7d, set in the console time picker.
// FALSE POSITIVES: shared NAT/proxy egress IPs linking unrelated legitimate sessions
// TUNING: exclude your known NAT/proxy egress ranges for legitimate admin traffic
// ⚠ validate in tenant: field names depend on your ISE syslog parser/repo schema; confirm against a sample ingested row before deploying
#repo=ise_syslog
| log_source=/^ise-kong\/access\.log$/i
| in(http_method, values=["POST","PUT","PATCH","DELETE"])
| groupBy([src_ip], function=[count(as=WriteHits), collect(uri_path, limit=20), collect(user_name, limit=20)], limit=1000)
| WriteHits > 0
| table([src_ip, WriteHits, uri_path, user_name])
| sort(WriteHits, order=desc)

Looks for: the blast radius of Q2 across every ISE node over a longer window, to scope whether exploitation attempts are isolated or environment-wide. FP: low; this is a rollup for scoping, not an alerting query.

// HUNT: Pivot: environment-wide anomalous-username hit count per ISE node, 30-day rollup
// MITRE: T1190
// CONF: medium
// FP: low
// COST: low
// REQUIRES: Cisco ISE ise-kong/access.log ingested into Falcon NG-SIEM (NOT native sensor telemetry). LOOKBACK: 30d, set in the console time picker.
// FALSE POSITIVES: minimal. This is a scoping rollup, not an alerting query
// ⚠ validate in tenant: field names depend on your ISE syslog parser/repo schema; confirm against a sample ingested row before deploying
#repo=ise_syslog
| log_source=/^ise-kong\/access\.log$/i
| user_name=/^(dummyuser|test|guest|admin1|null|undefined)$/i
| groupBy([ise_node], function=count(as=Hits), limit=200)
| sort(Hits, order=desc)