Coverage › CVE-2024-13159

CVE-2024-13159 Mapped Sigma

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Vendor / product

Ivanti — Endpoint Manager (EPM)

Description (CISA)

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

Added to KEV

2025-03-10

Due date

2025-03-31

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-36

CISA notes

https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US
https://nvd.nist.gov/vuln/detail/CVE-2024-13159

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1087 Account Discovery secondary impact

• DET0587 Enumeration of User or Account Information Across Platforms
  AN1612 Windows

  Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Security EventCode=4798, 4799 → DC0099 Group Enumeration

  Tunable: CommandLinePattern TimeWindow UserContext
  AN1613 Linux

  Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.

  auditd:SYSCALL PATH → DC0055 File Access

  linux:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: AccessedFile ParentProcessName
  AN1614 macOS

  Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.

  macos:unifiedlog process event → DC0032 Process Creation

  macos:unifiedlog DirectoryService queries retrieving account information → DC0013 User Account Metadata

  Tunable: CommandLine ExecutionContext
  AN1615 IaaS

  Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.

  AWS:CloudTrail DescribeUsers / ListUsers / GetUser → DC0083 Cloud Service Enumeration

  Tunable: API_Method CallerType
  AN1616 Identity Provider

  Detection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.

  azure:signinlogs Graph API Query → DC0083 Cloud Service Enumeration

  saas:okta User Enumeration Events → DC0013 User Account Metadata

  Tunable: QueryType AppContext
  AN1617 ESXi

  Detection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.

  esxi:vpxd vCenter Management → DC0064 Command Execution

  Tunable: CommandPattern PrivilegedSession
  AN1618 SaaS

  Account enumeration via bulk access to user directory features or hidden APIs.

  gcp:audit Directory API Access → DC0013 User Account Metadata

  Tunable: EndpointURL UserAgent
  AN1619 Office Suite

  Account discovery via VBA macros, COM objects, or embedded scripting.

  m365:unified Scripted Activity → DC0029 Script Execution

  Tunable: MacroName ExecutionScope

Sigma rules tagged attack.t1087 (16)

All 16 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

• DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
  AN0219 Windows

  Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

  ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList
  AN0220 Linux

  Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

  ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

  Tunable: WebProcList ChildToolList BurstThreshold TimeWindow
  AN0221 macOS

  Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

  macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content

  macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation

  NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

  Tunable: ServiceList TimeWindow
  AN0222 Containers

  Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

  ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content

  docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation

  NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

  Tunable: IngressNamespaces MetadataEndpoints TimeWindow
  AN0223 IaaS

  Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

  ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content

  AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

  Tunable: LBProjects ErrorBurst
  AN0224 ESXi

  Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

  esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content

  NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

  Tunable: MgmtCIDR TimeWindow
  AN0225 Network Devices

  Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

  networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content

  NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

  Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged attack.t1190 (149)

All 149 rules on the technique page →

T1550.002 Pass the Hash primary impact

• DET0409 Detection Strategy for T1550.002 - Pass the Hash (Windows)
  AN1144 Windows

  Detects anomalous NTLM LogonType 3 authentications that occur without accompanying domain logon events, especially from lateral systems or involving built-in administrative tools. Monitors for mismatches between source user context and system being accessed. Correlates LogonSession creation, NTLM authentications, and process/service initiation to identify suspicious use of stolen password hashes for remote access or service logon without password entry. Detects overpass-the-hash by combining Kerberos ticket issuance with NTLM-based lateral movement.

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4768 → DC0084 Active Directory Credential Request

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: TimeWindow SourceAccountAnomalyThreshold LogonTypeFilter

Sigma rules tagged attack.t1550.002 (6)

T1558 Steal or Forge Kerberos Tickets exploitation technique

• DET0522 Detect Kerberos Ticket Theft or Forgery (T1558)
  AN1443 Windows

  Detects anomalous Kerberos activity such as forged or stolen tickets by correlating malformed fields in logon events, RC4-encrypted TGTs, or TGS requests without corresponding TGT requests. Also detects suspicious processes accessing LSASS memory for ticket extraction.

  WinEventLog:Security EventCode=4672, 4634 → DC0088 Logon Session Metadata

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  Tunable: TicketLifetimeThreshold EncryptionTypes ProcessAllowlist
  AN1444 Linux

  Detects suspicious access to SSSD secrets database and Kerberos key material indicating ticket theft or replay attempts. Correlates anomalous file access with unusual Kerberos service ticket requests.

  auditd:SYSCALL Access to /var/lib/sss/secrets/secrets.ldb or .secrets.mkey → DC0055 File Access

  linux:syslog Unusual kinit or klist activity → DC0084 Active Directory Credential Request

  Tunable: SecretsAccessThreshold UnusualServiceAccounts
  AN1445 macOS

  Detects attempts to forge or replay Kerberos tickets by monitoring Unified Logs for anomalous kinit/klist activity and correlating unusual authentication sequences.

  macos:unifiedlog Unusual Kerberos TGS-REQ without TGT or anomalous ticket lifetime → DC0088 Logon Session Metadata

  Tunable: TicketRequestPatterns TicketLifetime

Sigma rules tagged attack.t1558 (6)