Unit 10: Edge devices and remote access · Lesson 2 of 5 · 24 min
Case file: answering an emergency directive
The VPN appliance's integrity check fails. Compare its own logs with the copy on the log server, find what was erased and what it touched inside.
case file
Ivanti Connect Secure Zero-Days
Ivanti Connect Secure / Policy Secure customers · 2024
Two chained zero-days (CVE-2023-46805 and CVE-2024-21887) in Ivanti Connect Secure VPN appliances allowed unauthenticated remote code execution; Volexity found activity dating to at least December 3, 2023, attributed to a suspected Chinese state actor (UTA0178). Attackers wiped appliance logs, harvested credentials and moved into internal networks. CISA's Emergency Directive 24-01 ordered agencies to disconnect, factory-reset and rebuild the appliances and reset associated credentials.
What went wrong
Internet-facing VPN appliances with critical authentication-bypass and command-injection flaws, where on-box logs could be wiped and integrity tools could be evaded.
What would have stopped it
- Forward appliance logs to an external syslog/SIEM so they cannot be erased on the device.
- Apply vendor mitigations and updates within 48 hours for edge devices, and factory-reset/rebuild suspected appliances rather than just patching.
- Treat credentials and secrets stored on or used through the appliance as compromised and rotate them.
- Restrict what the VPN appliance itself can reach internally (no direct RDP/SMB/SSH to arbitrary hosts).
What defenders could have seen
- Integrity checker events reporting new or mismatched files (for example SYS32039/SYS32040).
- Gaps in appliance logs or logging being disabled.
- Outbound connections or internal RDP/SMB/SSH originating from the appliance's own IP.
sourcescisa.govvolexity.com
mission
- You are
- The incident responder for edge devices.
- Situation
- A directive orders you to check your VPN appliances now. vpn01's integrity checker output, its on-box log and the copy forwarded to the syslog server are in
~/edge. This lab is modelled on the 2024 Ivanti Connect Secure case. - Goal
- Prove whether vpn01 is compromised, recover what the attacker erased and list what it reached internally.
- Hand in
- The evidence, the erased window, the internal targets and the next steps from the directive.
Why logs must leave the box
- vpn01 to Syslog server: every log line, as it happens
- Attacker to vpn01: gains root on the appliance
- Attacker to vpn01: truncates the local log
- Syslog server to Syslog server: still has every line
Read the integrity check
Vendors ship integrity checkers for exactly this moment. New or changed files on a sealed appliance mean tampering.
cat vpn01/integrity.txt
integrity check 2026-10-09T06:10:02Z vpn01
new files: 2
/home/webserver/htdocs/auth/login-helper.js
/tmp/.cache/sess.dat
mismatched files: 1
/home/perl/LogConfig.pm
result: FAIL
you should see Two new files and one changed file. The check failed.
Compare on-box and forwarded logs
If the appliance's own log is shorter than the forwarded copy, someone deleted lines.
wc -l vpn01/onbox.log syslog/vpn01.log 22 vpn01/onbox.log 34 syslog/vpn01.log 56 total diff vpn01/onbox.log syslog/vpn01.log | grep -c '^>' 12
you should see 12 lines exist only on the syslog server.
Read what was erased
Search the forwarded copy for the high-signal events.
grep -E 'shell|export|truncated|auth=none' syslog/vpn01.log
2026-10-09T02:14:12Z vpn01 web request POST /api/v1/system/maintenance status=200 auth=none
2026-10-09T02:15:03Z vpn01 admin shell started by uid=0 parent=web
2026-10-09T02:51:44Z vpn01 config export to 203.0.113.211
2026-10-09T03:23:05Z vpn01 log file truncated by uid=0
you should see An unauthenticated request succeeded, a root shell started, the config was exported and the local log was truncated.
List what the appliance reached inside
A VPN appliance passes user traffic, but it should never start connections to internal servers itself.
tail -n +2 vpn01/appliance-flows.csv | cut -d, -f3,4
10.20.0.100,3389
10.20.0.100,445
10.20.0.90,445
10.20.0.12,22
10.20.0.40,3389
you should see The appliance's own address opened remote desktop, SMB and SSH to five internal targets, including the domain controller.
defender tip The directive's order matters: disconnect, collect evidence, factory reset or rebuild, patch, then rotate every credential and secret the appliance held.
What a defender takes away
- 1Forward edge device logs off the box so they survive tampering.
- 2Run vendor integrity checks during every emergency directive.
- 3Patching a compromised appliance is not enough: rebuild it and rotate its credentials.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.