CVE-2026-10520 — Ivanti Sentry (MobileIron Sentry) Pre-Auth OS Command Injection

Looks for: HTTP POSTs to the vulnerable Sentry config URI. Accomplishes: surfaces every exploitation attempt and the source IPs hitting the gateway. ⚠ field names parser-dependent

// HUNT: POST to Ivanti Sentry handleMessage exploit endpoint (CVE-2026-10520)
// MITRE: T1190 | CONF: high  FP: medium  COST: low
// REQUIRES: Ivanti Sentry web/access logs ingested into LogScale/NG-SIEM
// FALSE POSITIVES: legitimate internal config tooling hitting the same path (rare, post-patch)
// TUNING: allow-list known management source IPs; focus on external/untrusted src since 2026-06-10
url=/\/mics\/api\/v2\/sentry\/mics-config\/handleMessage/i
| method=/POST/i
| table([@timestamp, src, method, url, status, http_user_agent, dst], limit=200)
| sort(@timestamp, order=desc)

Looks for: the exploit URI and an execute command in the request body/query — the actual RCE trigger, not just reconnaissance of the path. Accomplishes: highest-fidelity log signal for active exploitation. ⚠ body capture parser-dependent

// HUNT: Sentry handleMessage POST with command=execute (active RCE trigger)
// MITRE: T1190, T1059 | CONF: high  FP: low  COST: low
// REQUIRES: Sentry web logs WITH request body / query capture
// FALSE POSITIVES: very rare — the patch replaces user input with hardcoded commands
url=/\/mics\/api\/v2\/sentry\/mics-config\/handleMessage/i
| method=/POST/i
| request_body=/command\s*=\s*execute|"command"\s*:\s*"execute"/i
| table([@timestamp, src, url, request_body, status, http_user_agent], limit=200)
| sort(@timestamp, order=desc)

Looks for: the web-service process (Java/Tomcat/Sentry daemon) spawning a shell — the definitive post-exploitation fingerprint per vendor IOC guidance. Accomplishes: highest-fidelity sensor signal. Requires a Linux sensor on the appliance, or apply the same lineage logic to any reachable web host.

// HUNT: Web/Java/Tomcat service spawning a shell (Sentry RCE post-exploitation)
// MITRE: T1190, T1059 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 from a Linux sensor on the appliance or reachable web host
// FALSE POSITIVES: rare — web service legitimately shelling out is unusual; allow-list known scripts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(java|catalina\.sh|tomcat|httpd|nginx|mi|sentry)/i
| FileName=/^(sh|bash|dash|ksh|zsh)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: classic hands-on-keyboard recon (id, whoami, uname, hostname, reading /etc/passwd) whose parent is the web/Java service. FP: admin scripts / monitoring — scope by parent and allow-list. ⚠ baseline the appliance first

// HUNT: Recon commands spawned by the web/Java service after Sentry RCE
// MITRE: T1059, T1190 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with parent-process context (Linux sensor)
// FALSE POSITIVES: legitimate startup/health scripts run by the service account
// TUNING: restrict ParentBaseFileName to the Sentry/Tomcat service; allow-list known health checks
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(java|catalina\.sh|tomcat|httpd|nginx|sh|bash)/i
| FileName=/^(id|whoami|uname|hostname|ifconfig|ip|cat)$/i
| CommandLine=/whoami|\bid\b|uname|\/etc\/passwd|\/etc\/shadow|ifconfig|ip\s+a/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: curl/wget (or equivalents) pulling a payload, especially spawned by the web service or piping a remote script into a shell. FP: package updates / monitoring agents — allow-list known update sources.

// HUNT: curl/wget second-stage pull after Sentry RCE (ingress tool transfer / C2)
// MITRE: T1105, T1071 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 command-line telemetry (Linux sensor)
// FALSE POSITIVES: legitimate package/update fetches; monitoring agents
// TUNING: allow-list approved repo/update hosts; flag pulls piped to sh and parent=web service
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(curl|wget|fetch|tftp|python|python3|perl)$/i
| CommandLine=/https?:\/\/|ftp:\/\/|\|\s*(sh|bash)|-O\s|-o\s|--output/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: a script/JSP/executable written under a web root by the web service (webshell), or a shell launched with stdio redirected to a network socket (reverse shell one-liner). FP: legitimate deploys — scope to runtime, not deploy windows.

// HUNT: Webshell file drop under web root OR reverse-shell one-liner (Sentry persistence/C2)
// MITRE: T1505.003, T1059 | CONF: medium  FP: medium  COST: low
// REQUIRES: FileCreateInfo + ProcessRollup2 (Linux sensor)
// FALSE POSITIVES: legitimate application deployments writing to the web root
// TUNING: scope file writes to runtime (not deploy) windows; allow-list CI/CD service accounts
(#event_simpleName=/NewExecutableWritten|NewExecutableRenamed/
   | TargetFileName=/\/(webapps|www|html|htdocs|mics)\/.*\.(jsp|jspx|php|war|sh|py|pl)$/i)
OR (#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
   | CommandLine=/(bash|sh)\s+-i|\/dev\/tcp\/|mkfifo|nc\s+-e|socat|exec\s+\d+<>/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, TargetFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: a single source in the Sentry appliance subnet authenticating to many distinct internal hosts in a short window — credential reuse / lateral movement from the compromised gateway. FP: admin jump hosts / scanners — allow-list. Replace the CIDR with your Sentry/appliance subnet.

// HUNT: One appliance-segment source authenticating to many internal hosts (lateral movement)
// MITRE: T1021, T1078 | CONF: medium  FP: medium  COST: medium
// REQUIRES: UserLogon with RemoteAddressIP4 populated; known appliance subnet CIDR
// FALSE POSITIVES: legitimate admin jump hosts / vuln scanners in that subnet
// TUNING: set RemoteAddressIP4 to YOUR Sentry/appliance subnet; allow-list sanctioned admin sources
#event_simpleName=/UserLogon|UserLogonFailed/
| RemoteAddressIP4=/^10\.50\./
| groupBy([RemoteAddressIP4, UserName], function=([
    count(ComputerName, distinct=true, as=hostsTouched),
    collect([ComputerName])
  ]))
| hostsTouched >= 5
| sort(hostsTouched, order=desc)