What Changed
The file CVEExploitationOnNetworkAppliance3P.yaml was entirely replaced. The prior content was a different query (ID 7896ad97) hunting Azure network config write/delete operations via AzureActivity, DeviceInfo, and BehaviorAnalytics. The replacement (ID e54511b5) targets initial access and persistence indicators against third-party network appliances using CommonSecurityLog.
The workbook JSON received structural reordering (MITRE ATT&CK section sequencing corrected), a hardcoded workspace reference removed, and a UTF-8 BOM stripped to pass CI validators - no detection logic is embedded in the workbook.
Detection Logic
Primary data source: CommonSecurityLog (CEF via AMA - connector CefAma)
Vendor scope: Fortinet, Palo Alto Networks, Ivanti, Pulse Secure, SonicWall, Cisco, Check Point, Juniper, F5, Citrix
The query runs three independent detection methods unioned at the end:
Method 1 - CVE URL Path Matching (High confidence) Matches known exploit URL paths in RequestURL or Message against CVE-mapped signatures:
- /api/v1/totp/user-backup-code/ - CVE-2023-46805 (Ivanti auth bypass)
- /api/v1/license/keys-status/ - CVE-2024-21887 (Ivanti RCE)
- /api/v2/cmdb/system/admin/ - CVE-2022-40684 (Fortinet auth bypass)
- /vpns/page.aspx - CVE-2019-19781 (Citrix ADC directory traversal RCE)
- /remote/fgt_lang?lang= - CVE-2018-13379 (Fortinet SSL VPN path traversal)
Scanner noise (Qualys, Nessus) is filtered. Products containing ASM are excluded to suppress F5 WAF detections of inbound attacks against protected apps.
Method 2 - CVE String in Log Message (Medium confidence) Extracts any CVE-20xx-xxxxx string from appliance log messages as a catch-all for IPS/IDS telemetry. Additional exclusions: Nessus DNS callbacks, Cisco FTD event code 430002 (traffic-allowed, not threat), Cortex XDR endpoint detections, and ASM products.
Method 3 - FortiCloud SSO Bypass + Admin Creation Sequence (High confidence) Correlates FSSO-logon events with subsequent Fortinet event class 0100044547 (system.admin Add) on the same device within a 15-minute window. This targets FG-IR-26-060 (CVE-2026-24858), the FortiCloud SSO authentication bypass that allows an unauthenticated attacker to create a local administrator account.
Entity mappings: SourceIP (IP), DestinationIP (IP), Computer (Host)
MITRE Mapping
| Technique | Description |
|---|---|
| T1190 | Exploit Public-Facing Application |
| T1133 | External Remote Services |
| T1136.001 | Create Account: Local Account |
| T1070 | Indicator Removal |
Tactics: Initial Access, Persistence, Defense Evasion
Operational Notes
- The previous query (AzureActivity-based network config tamper hunting) is no longer present in this file. If that detection is needed, it must come from a separate rule - it has been displaced by this correction.
- Method 3 coverage of CVE-2026-24858 (FG-IR-26-060) is notable: this is a recently disclosed FortiCloud SSO bypass. Verify that your Fortinet appliances are forwarding CEF logs including FSSO and admin audit event classes to Sentinel.
- The DeviceProduct !has “ASM” exclusion should be reviewed if your environment uses F5 ASM and you want appliance-self-reported CVE hits - currently those are suppressed across Methods 1 and 2.
Affected Files
Solutions/Hybrid Attack - Cloud & Identity/Hunting Queries/InitialAccess/CVEExploitationOnNetworkAppliance3P.yaml
Solutions/Hybrid Attack - Cloud & Identity/Workbooks/HybridAttack-Cloud&Identity.json