Ivanti on Tarragonhttps://tarrragon.github.io/blog/tags/ivanti/Recent content in Ivanti on TarragonHugo -- gohugo.iozh-TWTarragon (CC BY 4.0)Thu, 30 Apr 2026 00:00:00 +0000Ivanti Connect Secure 2024:邊界設備批量利用壓力https://tarrragon.github.io/blog/backend/07-security-data-protection/blue-team/materials/field-cases/ivanti-connect-secure-2024-edge-mass-exploitation/Thu, 30 Apr 2026 00:00:00 +0000https://tarrragon.github.io/blog/backend/07-security-data-protection/blue-team/materials/field-cases/ivanti-connect-secure-2024-edge-mass-exploitation/<p>本案例的責任是提供邊界設備批量利用壓力素材。Ivanti Connect Secure 事件顯示,當 authentication bypass 與 command injection 兩個零日可被鏈成 RCE,且批量掃描在修補前已開始,防守方需要同時面對 patch、integrity check 與 forensic preserve 壓力。</p> <h2 id="來源">來源</h2> <table> <thead> <tr> <th>來源</th> <th>可引用範圍</th> </tr> </thead> <tbody> <tr> <td><a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b">CISA AA24-060B</a></td> <td>TTP、IOC、detection、exploitation chain</td> </tr> <tr> <td><a href="https://www.cisa.gov/news-events/alerts/2024/01/30/updated-new-software-updates-and-mitigations-defend-against-exploitation-ivanti-connect-secure-and">CISA Emergency Directive 24-01 (alert)</a></td> <td>修補節奏、disconnect 要求、integrity check tool</td> </tr> <tr> <td><a href="https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways">Ivanti security advisory</a></td> <td>CVE 範圍、修補版本、mitigation steps</td> </tr> <tr> <td><a href="https://censys.com/blog/the-mass-exploitation-of-ivanti-connect-secure/">Censys:Mass exploitation 觀察</a></td> <td>暴露面規模、批量利用 timeline</td> </tr> </tbody> </table> <h2 id="defender-pressure">Defender Pressure</h2> <table> <thead> <tr> <th>壓力</th> <th>服務判讀</th> </tr> </thead> <tbody> <tr> <td>Patch window pressure</td> <td>邊界設備需要在掃描成熟前完成修補</td> </tr> <tr> <td>Integrity check pressure</td> <td>修補後仍需執行 ICT 與 forensic preserve</td> </tr> <tr> <td>Disconnect pressure</td> <td>政府指引要求暫時下線高風險設備</td> </tr> <tr> <td>Hunting pressure</td> <td>修補前已被植入 web shell 的設備需要主動 hunting</td> </tr> </tbody> </table> <h2 id="control-gap">Control Gap</h2> <p>控制缺口的核心是邊界設備修補流程缺少「先 disconnect、再 patch、再驗證」的串接。當 emergency directive 要求臨時下線,服務團隊需要備援存取路徑與 session 收斂能力。</p> <h2 id="detection-route">Detection Route</h2> <table> <thead> <tr> <th>訊號</th> <th>判讀用途</th> <th>下一步</th> </tr> </thead> <tbody> <tr> <td>Ivanti integrity check tool 報告偏移</td> <td>判斷設備是否已被植入</td> <td>啟動 forensic preserve 與重建</td> </tr> <tr> <td>邊界設備在修補前出現異常請求</td> <td>判斷可能的零日利用</td> <td>啟動 <a href="https://tarrragon.github.io/blog/backend/07-security-data-protection/blue-team/materials/control-patterns/vulnerability-response-pattern/" data-link-title="Vulnerability Response Pattern" data-link-desc="定義漏洞回應如何從 observed 推進到 assessed、mitigated、patched、validated 與 closed">vulnerability response</a></td> </tr> <tr> <td>多台設備同時被掃描</td> <td>判斷批量利用節奏</td> <td>啟動 emergency disconnect 流程</td> </tr> </tbody> </table> <h2 id="exercise-hook">Exercise Hook</h2> <p>本案例可支撐 <a href="https://tarrragon.github.io/blog/backend/07-security-data-protection/blue-team/materials/scenarios/edge-session-hijack-game-day/" data-link-title="Edge Session Hijack Game Day" data-link-desc="以入口設備 session disclosure 風險設計 edge exposure game day">Edge session hijack game day</a> 的批量曝險變體。演練重點是確認 disconnect、integrity check、forensic preserve 與備援存取是否能在 emergency directive 時間壓力下協作。</p> <h2 id="write-back-target">Write-back Target</h2> <ul> <li><a href="https://tarrragon.github.io/blog/backend/07-security-data-protection/entrypoint-and-server-protection/" data-link-title="7.3 入口治理與伺服器防護" data-link-desc="以問題驅動方式整理對外入口、管理平面與伺服器邊界">7.3 入口治理與伺服器防護</a></li> <li><a href="https://tarrragon.github.io/blog/backend/07-security-data-protection/blue-team/vulnerability-response-state-machine/" data-link-title="7.B11 Vulnerability Response State Machine" data-link-desc="把漏洞回應拆成狀態機，建立 observed 到 closed 的可交接流程">7.B11 Vulnerability Response State Machine</a></li> <li><a href="https://tarrragon.github.io/blog/backend/07-security-data-protection/blue-team/materials/control-patterns/vulnerability-response-pattern/" data-link-title="Vulnerability Response Pattern" data-link-desc="定義漏洞回應如何從 observed 推進到 assessed、mitigated、patched、validated 與 closed">Vulnerability response pattern</a></li> <li><a href="https://tarrragon.github.io/blog/backend/07-security-data-protection/blue-team/materials/control-patterns/evidence-chain-pattern/" data-link-title="Evidence Chain Pattern" data-link-desc="定義事故與演練需要保存的訊號、決策、artifact、timeline 與 retention 證據">Evidence chain pattern</a></li> </ul>本案例的責任是提供邊界設備批量利用壓力素材。Ivanti Connect Secure 事件顯示,當 authentication bypass 與 command injection 兩個零日可被鏈成 RCE,且批量掃描在修補前已開始,防守方需要同時面對 patch、integrity check 與 forensic preserve 壓力。

來源

來源 可引用範圍
CISA AA24-060B TTP、IOC、detection、exploitation chain
CISA Emergency Directive 24-01 (alert) 修補節奏、disconnect 要求、integrity check tool
Ivanti security advisory CVE 範圍、修補版本、mitigation steps
Censys:Mass exploitation 觀察 暴露面規模、批量利用 timeline

Defender Pressure

壓力 服務判讀
Patch window pressure 邊界設備需要在掃描成熟前完成修補
Integrity check pressure 修補後仍需執行 ICT 與 forensic preserve
Disconnect pressure 政府指引要求暫時下線高風險設備
Hunting pressure 修補前已被植入 web shell 的設備需要主動 hunting

Control Gap

控制缺口的核心是邊界設備修補流程缺少「先 disconnect、再 patch、再驗證」的串接。當 emergency directive 要求臨時下線,服務團隊需要備援存取路徑與 session 收斂能力。

Detection Route

訊號 判讀用途 下一步
Ivanti integrity check tool 報告偏移 判斷設備是否已被植入 啟動 forensic preserve 與重建
邊界設備在修補前出現異常請求 判斷可能的零日利用 啟動 vulnerability response
多台設備同時被掃描 判斷批量利用節奏 啟動 emergency disconnect 流程

Exercise Hook

本案例可支撐 Edge session hijack game day 的批量曝險變體。演練重點是確認 disconnect、integrity check、forensic preserve 與備援存取是否能在 emergency directive 時間壓力下協作。

Write-back Target

]]>