CVE-2026-106047

Sentinel/Defender KQL

// This query attempts to detect unusual file access patterns that might indicate path traversal.
// It looks for attempts to access files outside of expected template directories by a web application process.
// This is a generic behavioral detection and needs to be tuned to the specific application (Ivanti Xtraction).
DeviceFileEvents
| where InitiatingProcessFileName =~ "xtraction.exe" or InitiatingProcessCommandLine contains "xtraction"
| where ActionType == "FileRead" or ActionType == "FileAccessed"
| where FileName !contains "template" // Adjust based on legitimate template directory names
| where FolderPath contains "..\\" or FolderPath contains "/../" or FileName contains "..\\" or FileName contains "/../"
| summarize count() by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
| where count_ > 5 // Adjust threshold to reduce false positives
| project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, count_

Splunk SPL

# This query attempts to detect unusual file access patterns that might indicate path traversal.
# It looks for attempts to access files outside of expected template directories by a web application process.
# This is a generic behavioral detection and needs to be tuned to the specific application (Ivanti Xtraction).
index=your_windows_security_logs OR index=your_linux_audit_logs
(process_name="xtraction.exe" OR cmd_line="*xtraction*")
(action="file_read" OR action="file_access")
NOT file_path="*template*" # Adjust based on legitimate template directory names
(file_path="*..\\*" OR file_path="*/../*" OR file_name="*..\\*" OR file_name="*/../*")
| stats count by host, process_name, cmd_line, file_name, file_path
| where count > 5 # Adjust threshold to reduce false positives

Sigma

title: Ivanti Xtraction Path Traversal Attempt
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects potential path traversal attempts in Ivanti Xtraction's template export functionality.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-106047
logsource:
    category: process_access
    product: windows
    service: sysmon # Or other relevant logging source
detection:
    selection:
        Image|endswith:
            - '\xtraction.exe'
        CommandLine|contains:
            - 'xtraction'
        TargetFilename|contains:
            - '..\'
            - '/../'
        # Exclude legitimate template directory access if known
        # TargetFilename|not contains:
        #    - '\templates\'
    condition: selection
fields:
    - Image
    - CommandLine
    - TargetFilename
level: high

Elastic ES|QL

// This query attempts to detect unusual file access patterns that might indicate path traversal.
// It looks for attempts to access files outside of expected template directories by a web application process.
// This is a generic behavioral detection and needs to be tuned to the specific application (Ivanti Xtraction).
from filebeat-* or winlogbeat-*
| where event.category == "file"
| where process.name == "xtraction.exe" or process.command_line : "*xtraction*"
| where event.action == "access" or event.action == "read"
| where not file.path : "*template*" // Adjust based on legitimate template directory names
| where file.path : "*..\\*" or file.path : "*/../*" or file.name : "*..\\*" or file.name : "*/../*"
| stats count() by host.name, process.name, process.command_line, file.name, file.path
| where count > 5 // Adjust threshold to reduce false positives
| project host.name, process.name, process.command_line, file.name, file.path, count