Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: CVE-2023-38714 IBM Cloud Pak System 2 RCE Exploitation Activity
id: 7270bf98-1239-4e24-afe6-4c803e17d239
status: experimental
description: |
Detects exploitation of CVE-2023-38714 (IBM Cloud Pak System 2 Remote Code
Execution). This rule is a starting point — tune for your environment.
The vulnerability allows authenticated attackers to execute arbitrary
commands via crafted API requests. This detection covers suspicious
process execution spawned by IBM Cloud Pak services (e.g., Liberty,
WebSphere, node, python) and characteristic network beaconing patterns
to external C2 infrastructure following exploitation.
CVSS: 9.1 (Critical) | KEV Status: Not listed on CISA KEV as of rule date.
author: SARA Detection Engineering
date: 2026-10-08
references:
- https://nvd.nist.gov/vuln/detail/CVE-2023-38714
- https://www.ibm.com/support/pages/node/7015647
- https://exchange.xforce.ibmcloud.com/vulnerabilities/260734
tags:
- attack.initial_access
- attack.execution
- attack.t1190
- attack.t1059
- attack.t1059.004
- attack.t1059.006
logsource:
product: windows
category: process_creation
detection:
selection_suspicious_child_process:
ParentImage|contains:
- 'java'
- 'node'
- 'python'
- 'bash'
- 'sh'
- 'powershell'
- 'cmd'
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\bash.exe'
- '\sh.exe'
- '\whoami.exe'
- '\net.exe'
- '\net1.exe'
- '\hostname.exe'
- '\ipconfig.exe'
- '\systeminfo.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
- '\wget.exe'
- '\nc.exe'
- '\python.exe'
- '\python3.exe'
- '\perl.exe'
- '\ruby.exe'
selection_ibm_cps_context:
ParentImage|contains:
- 'ibm'
- 'cloudpak'
- 'cognos'
- 'websphere'
- 'liberty'
- 'spark'
- 'zen'
- 'wsadmin'
- 'cpd'
- 'cp4d'
selection_suspicious_cli_patterns:
CommandLine|contains:
- 'whoami'
- 'net user'
- 'net localgroup'
- 'ipconfig /all'
- 'systeminfo'
- 'tasklist'
- 'netstat -an'
- 'certutil -urlcache'
- 'certutil -decode'
- 'powershell -enc'
- 'powershell -e '
- 'bash -i'
- 'sh -i'
- 'nc -e'
- 'python -c'
- 'perl -e'
- 'curl http'
- 'wget http'
- '/dev/tcp/'
- 'base64 -d'
- 'chmod +x'
filter_legitimate_admin:
ParentImage|contains:
- '\Program Files\IBM\WebSphere'
- '\Program Files\IBM\SPSS'
User|contains:
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
CommandLine|contains:
- 'health_check'
- 'status_check'
- 'version_check'
condition: (selection_suspicious_child_process and selection_ibm_cps_context) or (selection_suspicious_child_process and selection_suspicious_cli_patterns) and not filter_legitimate_admin
falsepositives:
- Legitimate IBM Cloud Pak administrative scripts that spawn shell commands for health checks
- DevOps automation pipelines running maintenance tasks through IBM Cloud Pak orchestration
- Monitoring agents installed alongside IBM Cloud Pak that perform system inventory
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →