Perimeter and remote-access appliances are valuable targets because successful compromise can provide access before traffic reaches internal security controls. The source defines campaign-specific hunts for Ivanti Connect Secure exploitation.

Coverage includes CVE-2025-0282 and CVE-2025-22457.

Reconnaissance and Anti-Forensics Indicators

The first query searches logs for known launcher filenames and commands associated with reducing visibility or changing the appliance state:

full_log:("hc_launcher.22.7.2.2615.jar" or "hc_launcher.22.7.2.3191.jar" or "hc_launcher.22.7.2.3221.jar" or "hc_launcher.22.7.2.3431.jar" or "setenforce 0" or "dport 514 -j DROP" or "dport 6514 -j DROP" or "mount -o remount,rw /" or "sed -i" or "dmesg -C")

The source recorded zero matches during the previous 30 days.

Known File Paths

A second query hunts for file paths associated with observed campaigns:

(rule.groups:syscheck and syscheck.path:(/tmp/s or /tmp/svb or /tmp/.t or /tmp/.i or /tmp/.r or /tmp/.liblogblock.so or /home/webserver/htdocs/dana-na/jam/getComponent.cgi or /home/webserver/htdocs/dana-na/auth/restAuth.cgi or /root/home/lib/libsshd.so or /root/home/lib/libsocks5.so or /root/lib/libupgrade.so or /lib/libdsupgrade.so or /bin/dsmain)) or full_log:("/tmp/.liblogblock.so" or "/home/webserver/htdocs/dana-na/jam/getComponent.cgi" or "/home/webserver/htdocs/dana-na/auth/restAuth.cgi" or "/root/home/lib/libsshd.so" or "/root/home/lib/libsocks5.so" or "/root/lib/libupgrade.so" or "/lib/libdsupgrade.so")

The source also recorded zero matches.

Known MD5 Values

The third hunt searches for a set of published MD5 values:

syscheck.md5_after:(e7d24813535f74187db31d4114f607a1 or a638fd203ddb540d0484d8e00490df06 or 4628a501088c31f53b5c9ddf6788e835 or e5192258c27e712c7acf80303e68980b or 6e01ef1367ea81994578526b3bd331d6 or ce2b6a554ae46b5eb7d79ca5e7f440da or 10659b392e7f5b30b375b94cae4fdca0)

Again, the source recorded zero matches.

Why Multiple Indicator Types Matter

Campaign-specific hunting benefits from using several types of evidence. A filename may change. A hash may only match one sample. Anti-forensics behavior can appear even when a known implant is not present.

Combining logs, file paths, and hashes provides more coverage than relying on a single indicator.

Investigation Workflow

Any match should be treated as a strong lead and correlated with:

• appliance administrative logins;

• configuration changes;

• file integrity events;

• logging interruptions;

• unusual outbound traffic;

• nearby authentication activity.

Operational Value

The source did not identify Ivanti-specific matches in the 30-day period. That is useful because it establishes a clean baseline.

These hunts can remain active as focused campaign detections while broader appliance behavior is covered by generic edge-device analytics.