Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Potential CVE-2020-1938 Ghostcat Exploit - AJP Request with Include Attributes
id: 9168f79e-d6f9-47c1-aff8-119bf413e5b9
status: experimental
description: |
Detects potential exploitation of CVE-2020-1938 (Ghostcat) in Apache Tomcat.
The vulnerability in the AJP connector allows attackers to read arbitrary
files and potentially achieve RCE via crafted AJP requests containing
javax.servlet.include.* attributes. CISA KEV-listed (CVSS 9.8).
This is a starting point — tune for your environment, especially the
AJP port list and any legitimate internal AJP consumers.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2020-1938
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://github.com/00theway/Ghostcat-CNVD-2020-10487
- https://lists.apache.org/thread/r3q2kfsx6dgossjlvhxcl4qysq9jlhjl
author: SARA Detection Engineering
date: 2026-10-16
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection_ajp_port:
cs-method|contains:
- AJP
selection_include_attrs:
cs-uri-query|contains:
- "javax.servlet.include.request_uri"
- "javax.servlet.include.servlet_path"
- "javax.servlet.include.path_info"
selection_lfi_paths:
cs-uri-stem|contains:
- "WEB-INF/web.xml"
- "WEB-INF/classes/"
- "WEB-INF/lib/"
- "/etc/passwd"
- "WEB-INF/"
filter_legitimate_ajp:
c-ip|cidr:
- "10.0.0.0/8"
- "172.16.0.0/12"
- "192.168.0.0/16"
condition: (selection_include_attrs or selection_lfi_paths) and not filter_legitimate_ajp
fields:
- c-ip
- cs-method
- cs-uri-stem
- cs-uri-query
- cs-user-agent
- sc-status
falsepositives:
- Legitimate internal AJP reverse-proxy traffic from trusted subnets (filtered by default)
- Tomcat admin tools that legitimately query WEB-INF paths
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →