CVE-2026-12645

Sentinel/Defender KQL

// Erkennung von ungewöhnlichen Prozessstarts oder Dateimodifikationen auf Ivanti Neurons for ITSM Servern
DeviceProcessEvents
| where InitiatingProcessFileName has "w3wp.exe" or InitiatingProcessFileName has "iisexpress.exe" // Typische IIS-Prozesse für Webanwendungen
| where FileName !in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "sh.exe") // Prozesse, die oft für Code-Ausführung missbraucht werden, aber hier als ungewöhnlich gelten
| where ProcessCommandLine has_any ("-c", "/c", "-exec", "-command") // Indikatoren für Befehlsausführung
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| extend AlertMessage = "Potenzielle Code-Ausführung auf Ivanti Neurons for ITSM Server entdeckt."

Splunk SPL

// Erkennung von ungewöhnlichen Prozessstarts oder Dateimodifikationen auf Ivanti Neurons for ITSM Servern
index=your_windows_server_index sourcetype=WinEventLog:Security EventCode=4688 OR EventCode=4663
| where (ParentProcessName="w3wp.exe" OR ParentProcessName="iisexpress.exe")
| where NOT (NewProcessName IN ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "sh.exe"))
| where CommandLine LIKE "*-c*" OR CommandLine LIKE "*/c*" OR CommandLine LIKE "*-exec*" OR CommandLine LIKE "*-command*"
| stats count by host, ParentProcessName, NewProcessName, CommandLine
| rename host as DeviceName, ParentProcessName as InitiatingProcessFileName, NewProcessName as FileName, CommandLine as ProcessCommandLine
| eval AlertMessage = "Potenzielle Code-Ausführung auf Ivanti Neurons for ITSM Server entdeckt."

Sigma

title: Ivanti Neurons for ITSM - Potentielle Code-Ausführung
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Erkennt ungewöhnliche Prozessstarts, die auf eine Code-Ausführung auf Ivanti Neurons for ITSM Servern hindeuten könnten.
author: SecBoard
date: 2024/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\iisexpress.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
    CommandLine|contains:
      - '-c'
      - '/c'
      - '-exec'
      - '-command'
  condition: selection
level: high

Elastic ES|QL

// Erkennung von ungewöhnlichen Prozessstarts oder Dateimodifikationen auf Ivanti Neurons for ITSM Servern
from process where event.type == "start" and (process.parent.executable.name == "w3wp.exe" or process.parent.executable.name == "iisexpress.exe") and not (process.executable.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "sh.exe")) and (process.args contains "-c" or process.args contains "/c" or process.args contains "-exec" or process.args contains "-command")
| stats count() by host.name, process.parent.executable.name, process.executable.name, process.command_line
| set AlertMessage = "Potenzielle Code-Ausführung auf Ivanti Neurons for ITSM Server entdeckt."