Guardians of the Haaglaxy

## Story
- Ivanti Virtual Traffic Manager CVE-2024-7593

## Analytic
- Ivanti VTM New Account Creation

detections/application/ivanti_vtm_new_account_creation.yml

@@ -0,0 +1,55 @@
+name: Ivanti VTM New Account Creation
+id: b04be6e5-2002-4a49-8742-52285635b8f5
+version: 1
+date: '2024-08-19'
+author: Michael Haag, Splunk
+data_sources: []
+type: TTP
+status: production
+description: This analytic detects potential exploitation of the Ivanti Virtual Traffic Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new administrator accounts. The vulnerability allows unauthenticated remote attackers to bypass authentication on the admin panel and create new admin users. This detection looks for suspicious new account creation events in the Ivanti vTM audit logs that lack expected authentication details, which may indicate exploitation attempts.
+search: '`ivanti_vtm_audit`
+  | where OPERATION="adduser" MODGROUP="admin" IP="!!ABSENT!!"
+  | stats count min(_time) as firstTime max(_time) as lastTime by IP, MODUSER, OPERATION, MODGROUP, AUTH
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `ivanti_vtm_new_account_creation_filter`'
+how_to_implement: To implement this detection, ensure that Ivanti vTM audit logs are being ingested into Splunk. Configure the Ivanti vTM to send its audit logs to Splunk via syslog or by monitoring the log files directly. The sourcetype should be set to "ivanti_vtm_audit" or a similar custom sourcetype for these logs.
+known_false_positives: Legitimate new account creation by authorized administrators will generate similar log entries. However, those should include proper authentication details. Verify any detected events against expected administrative activities and authorized user lists.
+references:
+- https://www.ivanti.com/security/security-advisories/ivanti-virtual-traffic-manager-vtm-cve-2024-7593
+- https://nvd.nist.gov/vuln/detail/CVE-2024-7593
+tags:
+  analytic_story:
+  - Ivanti Virtual Traffic Manager CVE-2024-7593
+  asset_type: Web Application
+  confidence: 80
+  impact: 90
+  message: A new administrator account, $MODUSER$, was created on Ivanti vTM device without proper authentication, which may indicate exploitation of CVE-2024-7593.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: MODUSER
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - IP
+  - MODUSER
+  - OPERATION
+  - MODGROUP
+  - AUTH
+  risk_score: 72
+  security_domain: access
+  cve:
+  - CVE-2024-7593
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ivanti/ivanti_vtm_audit.log
+    sourcetype: ivanti_vtm_audit
+    source: ivanti_vtm_audit

macros/ivanti_vtm_audit.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=ivanti_vtm_audit
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: ivanti_vtm_audit

stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml

@@ -0,0 +1,20 @@
+name: Ivanti Virtual Traffic Manager CVE-2024-7593
+id: 28e88e97-3494-45a6-87d5-76065cccf8d2
+version: 1
+date: '2024-08-19'
+author: Michael Haag, Splunk
+description: This analytic story addresses the critical authentication bypass vulnerability (CVE-2024-7593) in Ivanti Virtual Traffic Manager (vTM). Disclosed in August 2024, this flaw affects vTM versions prior to 22.2R1 and 22.7R2, allowing unauthenticated remote attackers to access the admin panel and create new administrator accounts. Such access could potentially lead to full system compromise. The story provides detections for potential exploitation attempts, focusing on unauthorized account creation and suspicious administrative activities. It aims to help organizations identify and respond to possible attacks leveraging this vulnerability, emphasizing the importance of timely patching and thorough investigation of any suspicious events.
+narrative: In August 2024, a critical vulnerability (CVE-2024-7593) was disclosed in Ivanti Virtual Traffic Manager (vTM) versions prior to 22.2R1 and 22.7R2. This authentication bypass flaw allows unauthenticated remote attackers to access the admin panel and create new administrator accounts, potentially leading to full system compromise. Exploitation of this vulnerability typically involves an attacker accessing the vTM management interface, bypassing authentication using the vulnerability, creating a new administrator account without proper authorization, and potentially using the new account for further malicious activities. This analytic story includes detections to identify suspicious account creation events and other indicators of exploitation. It is crucial for organizations using affected Ivanti vTM versions to update to a patched version immediately and investigate any potential compromise. By leveraging these detections, security teams can enhance their ability to detect and respond to potential attacks exploiting this critical vulnerability in their Ivanti vTM deployments.
+references:
+  - https://www.ivanti.com/security/security-advisories/ivanti-virtual-traffic-manager-vtm-cve-2024-7593
+  - https://nvd.nist.gov/vuln/detail/CVE-2024-7593
+tags:
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
+  cve:
+  - CVE-2024-7593