Ivanti EPMM CVE-2025-4427/4428 exploitation. Feature usage API abuse.

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•0•27

This rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. The first signature identifies requests to the '/api/v2/featureusage' endpoint containing patterns indicative of remote code execution (e.g., '${', 'Runtime', 'getRuntime', 'exec'). The second signature detects requests for a '.jsp' file named '403', which could indicate a backdoor or web shell deployment post-exploitation.