Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Adobe ColdFusion CVE-2023-38205 Improper Access Control Exploitation
id: c259a623-1839-421b-8ae4-9e6b48057b94
status: experimental
description: |
Detects potential exploitation of CVE-2023-38205, an improper access control vulnerability in Adobe ColdFusion.
This rule looks for POST requests to specific ColdFusion endpoints (CFM/CFC) with parameters associated with
deserialization, RCE, or component manipulation. CISA has listed this CVE in the Known Exploited Vulnerabilities (KEV) catalog.
CVSS Base Score: 7.4 (High). KEV Status: Exploited.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2023-38205
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html
author: SARA Detection Engineering
date: 2026-08-15
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection_method:
cs-method: POST
selection_uri:
cs-uri-stem|contains:
- '.cfm'
- '.cfc'
selection_params:
cs-uri-query|contains:
- '_cfclient'
- 'method='
- 'component='
- 'argumentCollection='
- 'service='
- 'returnformat='
filter_legitimate_get:
cs-method: GET
condition: selection_method and selection_uri and selection_params and not filter_legitimate_get
falsepositives:
- Legitimate ColdFusion application development or administrative tasks that use POST requests with method or component parameters.
- Automated vulnerability scanners testing ColdFusion instances.
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →