Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Oracle WebLogic CVE-2020-14883 Arbitrary File Write to JSP
id: 0cbe079a-58d5-4561-ae8e-3b9453572601
status: experimental
description: |
Detects exploitation attempts of CVE-2020-14883 targeting Oracle WebLogic Server.
CVE-2020-14883 allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.
This rule identifies HTTP POST requests attempting to write JSP files to WebLogic directories, which is characteristic of webshell deployment.
CVSS Base Score: 9.8 (CRITICAL). CISA KEV: Yes.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2020-14883
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.oracle.com/security-alerts/cpuoct2020.html
author: SARA Detection Engineering
date: 2026-08-15
tags:
- attack.t1190
- attack.t1505.003
logsource:
category: webserver
detection:
selection_method:
cs-method: POST
selection_uri:
cs-uri-stem|contains:
- 'console/images'
- 'console/css'
- 'console/framework'
- 'bea_wls_internal/'
selection_payload:
cs-uri-query|contains:
- '.jsp'
filter_legitimate:
cs-user-agent|contains:
- 'WebLogic'
- 'Oracle'
condition: selection_method and selection_uri and selection_payload and not filter_legitimate
fields:
- c-ip
- cs-host
- cs-method
- cs-uri-stem
- cs-uri-query
- cs-user-agent
- sc-status
falsepositives:
- Legitimate administrative updates to WebLogic console resources
- Custom WebLogic application deployments writing to framework directories
level: critical
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →