Skip to content
.ca
sign in
detection rulehost

IvantiSentry post-exploitation host hunts (CVE-2026-10520)

First seen
2026-06-21
Last seen
2026-06-21
Used in
1 post
HostIvantiSentry post-exploitation host hunts (CVE-2026-10520)
# IvantiSentry post-exploitation host hunts (CVE-2026-10520)

# UID-0 backdoor accounts other than root (catches `useradd -o -u 0 ... adm2`)
awk -F: '($3==0 && $1!="root"){print}' /etc/passwd

# JSP/PHP dropped into MICS Tomcat webroots
find /opt/mi /opt/ivanti -type f \( -name '*.jsp' -o -name '*.php' \) -newermt '2026-06-09' 2>/dev/null

# Evidence of history clearing on operator/service accounts
find /home -maxdepth 2 -name '.bash_history' -size 0 2>/dev/null

Posts using this rule