hexastrike/ivanti-connect-secure-logs-parserA Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, and CVE-2024-21887.
This repository provides a Python script designed to convert Ivanti Secure Connect .vc0 log files into CSV format for digital forensics and incident response. In particular, the parser:
.vc0 files).
The tool was originally developed while investigating CVE-2025-0282 (an unauthenticated RCE vulnerability affecting certain Ivanti appliances). Reports from Mandiant and others indicate that threat actors may remove or alter log entries to hide their activities. By parsing and analyzing these .vc0 files, investigators can more easily spot evidence of compromise, unusual deletions, or other suspicious behavior.
During multiple incident response engagements involving Ivanti Secure Connect, certain appliances were found to exhibit incomplete or tampered logs—some showed no entries at all until exploitation of CVE-2025-0282 was detected and the appliance was rebooted. Additionally, the built-in integrity checks, which typically run every two hours, may be disabled or altered by an attacker. By converting .vc0 files into a more user-friendly CSV format, this tool helps investigators identify anomalies, such as missing log entries, unexpected authentication attempts, and potential signs of data manipulation.
PS F:\Case20250109001> python .\ics_logs_parser.py -h
usage: ics_logs_parser.py [-h] --input INPUT --output OUTPUT --mapfile MAPFILE
Process .vc0 files and convert them to .csv files.
options:
-h, --help show this help message and exit
--input INPUT Directory containing .vc0 files
--output OUTPUT Directory to save .csv files
--mapfile MAPFILE CSV file mapping [MessageCode, MessageType, Description]
python .\ics_logs_parser.py --input "F:\Case20250109001\root_runtime.img\[root]\runtime\logs" --output .\logs\ --map .\logmessages_map.csv
--input: Directory containing .vc0 log files extracted from Ivanti Secure Connect.--output: Directory where the CSVs will be written.--mapfile: CSV file mapping each message code to a message type and description.
logmessages_map.csv stores the known message codes and their corresponding message types and descriptions. While this list (sourced from publicly available Ivanti documentation and community research) is extensive, it may not include every message code in existence. We encourage users to review or customize the mapping as needed for their environment. See the Resources section for the original references.
By default, timestamps are converted to UTC. If you need to localize them or format them differently, you can modify the datetime.fromtimestamp(...) call in the process_subline() function.
If you have questions, suggestions, or need assistance, feel free to reach out at [email protected].