Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: CVE-2016-4657 Pegasus iOS Exploit Kit Network Delivery Attempt
id: 449c5968-d304-44f9-813d-6e5550b837bb
date: 2026-08-18
status: experimental
description: >
Detects network-based exploitation attempts targeting CVE-2016-4657 (iOS Kernel Memory Corruption).
This vulnerability was actively exploited by the Pegasus spyware (APT28/NSO Group).
CISA KEV-listed. This rule looks for characteristic HTTP requests associated with the exploit delivery.
Starting point — tune for your environment.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2016-4657
- https://citizenlab.ca/2016/08/million-dollar-dissident/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: SARA Detection Engineering
tags:
- attack.t1068
- attack.t1190
- attack.t1204.002
logsource:
category: proxy
detection:
selection_exploit_uri:
cs-method: GET
cs-uri-stem|contains:
- "/exploit.html"
- "/install.html"
- "/pegasus"
- "/trident"
selection_ua_anomalous:
cs-user-agent|contains:
- "Mozilla/5.0 (iPhone; CPU iPhone OS"
- "WebKit/"
cs-uri-query|contains:
- "payload"
- "stage"
- "exploit"
filter_legitimate_apple:
cs-host|endswith:
- ".apple.com"
- ".icloud.com"
condition: (selection_exploit_uri or (selection_ua_anomalous and not filter_legitimate_apple)) and not filter_legitimate_apple
fields:
- c-ip
- cs-host
- cs-method
- cs-uri-stem
- cs-uri-query
- cs-user-agent
- sc-status
falsepositives:
- Legitimate security research or vulnerability scanning of iOS devices.
- Mobile device management (MDM) platforms pushing legitimate iOS payloads.
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →