Chrome bloodhound robot sniffing a trail of glowing sparks through a server corridor, hunting Ivanti Connect Secure header mismatch signals, navy red and chrome on aged paper, no text

Hunt: Ivanti Connect Secure X-DSCGI-PATH mismatch

Home » Hunt Lab » Hunt: Ivanti Connect Secure X-DSCGI-PATH mismatch

Companion hunt to the Ivanti Connect Secure CVE-2026-104935 Alert. The high-value signal is an X-DSCGI-PATH header that disagrees with the public URL path — not a single CGI blocklist.

Hypothesis

If an Ivanti Connect Secure appliance was hit with the unauthenticated chain Volexity tracks under UTA0576, proxy or WAF logs will show bursts to /dana-na/auth/url_default/welcome.cgi whose X-DSCGI-PATH names a privileged CGI (observed wu.cgi) or a short-lived /home/runtime/tmp/<md5> race target. Commands ride the HTTPS responses; no durable webshell is required. Integrity Checker Tool (ICT) can miss in-memory library patches that are restored after each run.

Data sources

  • Reverse proxy / WAF / Front Door with custom request headers retained (mandatory for mismatch detection)
  • Perimeter firewall / VPN session logs for lateral movement originating from the ICS address
  • Memory and network forensics on suspected appliances (disk ICT alone is not enough)

ATT&CK

  • T1190 Exploit Public-Facing Application
  • T1059 Command and Scripting Interpreter
  • T1003 OS Credential Dumping
  • T1040 Network Sniffing
  • T1070 Indicator Removal
  • T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Queries

Sigma flags welcome.cgi requests whose retained query/raw fields also name X-DSCGI-PATH, wu.cgi, or /home/runtime/tmp/. True header-vs-URL mismatch needs your WAF schema — use the hand KQL against CommonSecurityLog or Front Door diagnostics. Endpoint-only MDE tables will not see HTTP headers.

CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has "/dana-na/auth/"
| extend Raw = strcat(Message, " ", RequestContext, " ", AdditionalExtensions)
| where Raw has "X-DSCGI-PATH" or Raw has "wu.cgi" or Raw has "/home/runtime/tmp/"
| project TimeGenerated, DeviceName, SourceIP, RequestURL, RequestMethod, ResultCode, Raw

Triage (Integrity Checker caveat)

  1. Patch to a fixed build (25.1.1.2 / 25.1.3.0 / 25.1.3.1 / 22.8R2.5) — KEV federal due date is overdue.
  2. A clean ICT run does not clear suspicion. Prefer memory + network forensics, then factory reset / rebuild per CISA and Ivanti recovery guidance.
  3. On-box (with proper access): unexpected scripts under /tmp/, hidden /data/.icscap/ (renamed sniffer dsstatmond), truncated debuglog / audit.log windows.
  4. Hunt downstream for LDAP/Kerberos spray and credential use starting from the ICS appliance.

False positives

Scanners replaying Volexity path strings after 13 Oct 2026; rare health checks that set custom headers. Prefer mismatch logic over single-path denies — Volexity expects path rotation.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)