Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Barracuda ESG CVE-2023-2868 Post-Exploitation Command Execution
id: 999d0888-a061-47df-91ce-916762d9a900
status: experimental
description: |
Detects post-exploitation command execution patterns associated with CVE-2023-2868 in Barracuda ESG.
CVE-2023-2868 is a critical (CVSS 9.8) remote code execution vulnerability in the Barracuda Email Security Gateway (appliance form factor only) caused by a failure to comprehensively sanitize the processing of TAR file uploads. CISA listed this CVE in the Known Exploited Vulnerabilities (KEV) catalog on May 23, 2023, following active exploitation by threat actors deploying malware (such as the SALR backdoor) directly on the appliances. This rule is a starting point — tune for your environment.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2023-2868
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.barracuda.com/company/legal/product-bulletins
date: 2026-08-15
author: SARA Detection Engineering
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059.004
logsource:
product: linux
category: process_creation
detection:
selection_exploit_cmd:
# The exploit injects shell commands via the filename of a TAR attachment.
# The appliance processes this via Perl scripts, often resulting in shell execution.
# We look for characteristic command-line artifacts of the exploit payload.
CommandLine|contains:
- 'tar -zxvf'
- 'perl -e'
- 'curl http'
- 'wget http'
- 'chmod +x'
- 'python -c'
selection_exploit_paths:
# Threat actors (e.g., UNC3236) deployed custom backdoors and utilities in these paths.
Image|contains:
- '/var/tmp/'
- '/tmp/'
- '/var/percept/'
- '/home/product/code/config/'
filter_admin_maintenance:
# Filter out routine administrative commands if they overlap, though the combination above is rare.
User|contains:
- 'admin'
- 'root'
condition: (1 of selection_exploit_cmd and 1 of selection_exploit_paths) and not filter_admin_maintenance
falsepositives:
- Legitimate administrative scripts running maintenance tasks on the Barracuda appliance.
- Custom anti-spam or filtering scripts deployed by authorized administrators.
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →