CVE-2026-118527

Sentinel/Defender KQL

DeviceFileEvents
| where InitiatingProcessFileName in ("httpd", "nginx", "tomcat") // Common web server processes
| where FileName has_any (".jsp", ".php", ".asp", ".sh", ".py") // Suspicious file extensions
| where FolderPath contains "/data/" or FolderPath contains "/tmp/" // Known or temporary upload locations
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| where count_ > 1 // Look for multiple uploads of the same file or to the same location
| project DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256, count_

Splunk SPL

index=your_ivanti_logs sourcetype=ivanti_connect_secure (file_upload OR upload) (path="*/data/*" OR path="*/tmp/*") (filename IN ("*.jsp", "*.php", "*.asp", "*.sh", "*.py")) | stats count by host, user, filename, path | where count > 1

Sigma

title: Ivanti Connect Secure Predictable Filename Upload
id: 9a1b2c3d-4e5f-6789-abcd-ef0123456789
status: experimental
description: Detects suspicious file uploads to Ivanti Connect Secure devices indicative of CVE-2026-118527 exploitation.
author: SecBoard
date: 2026/11/02
logsource:
  product: ivanti
  service: connect_secure
detection:
  selection:
    event_type: file_upload
    file_path|contains:
      - '/data/'
      - '/tmp/'
    file_extension|contains:
      - 'jsp'
      - 'php'
      - 'asp'
      - 'sh'
      - 'py'
  condition: selection
fields:
  - user
  - file_name
  - file_path
level: medium

Elastic ES|QL

from file where event.type == "file" and event.action == "creation" and process.name in ("httpd", "nginx", "tomcat") and file.extension in ("jsp", "php", "asp", "sh", "py") and file.path regex ".*/(data|tmp)/.*" group by host.name, process.name, file.name, file.path, file.hash.sha256 aggregate count() as file_count having file_count > 1