Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Potential CVE-2016-3718 ImageTragick Command Injection
id: e31788dd-de87-45b4-a235-68bab0099dc9
date: 2026-08-18
status: experimental
description: >
Detects exploitation of CVE-2016-3718 (ImageTragick), a command injection
vulnerability in ImageMagick. Attackers craft malicious image files (MVG, MSL, SVG)
containing shell commands that are executed when ImageMagick processes the file.
This rule identifies suspicious child processes spawned by ImageMagick utilities
(convert, identify, magick) that indicate command injection via the MVG/MSL parser.
CVSS: 9.8 (Critical) | CISA KEV: Listed.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2016-3718
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://imagetragick.com/
- https://github.com/ImageMagick/ImageMagick/issues/13
author: SARA Detection Engineering
tags:
- attack.execution
- attack.t1059
- attack.t1059.004
- attack.t1203
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- '/convert'
- '/identify'
- '/magick'
- '/mogrify'
- '/composite'
- '/montage'
- '/display'
- '/animate'
- '/import'
- '/conjure'
selection_child:
ParentImage|endswith:
- '/convert'
- '/identify'
- '/magick'
- '/mogrify'
- '/composite'
- '/montage'
- '/display'
- '/animate'
- '/import'
- '/conjure'
filter_legitimate:
Image|endswith:
- '/gs'
- '/gsc'
condition: selection_child and not filter_legitimate
falsepositives:
- Legitimate ImageMagick processing pipelines that invoke external tools via delegates
- Custom scripts named 'convert' or 'identify' that are not ImageMagick
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →