Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Fujitsu ISM ismsnap Sensitive Information Access — CVE-2023-39379
id: 35e87950-54f8-4d59-bdeb-5ca8518afac2
status: experimental
description: |
Detects access to Fujitsu Software Infrastructure Manager (ISM) maintenance
data endpoints and ismsnap output directories that store sensitive information
in cleartext (CVE-2023-39379). An attacker may retrieve credentials and
configuration data by accessing ismsnap maintenance data through the ISM web
interface or by reading ismsnap files directly on the server.
This rule is a starting point — tune for your environment.
references:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39379
- https://www.fujitsu.com/jp/products/software/infrastructure-manager/
- https://nvd.nist.gov/vuln/detail/CVE-2023-39379
author: SARA Detection Engineering
date: 2026-10-08
tags:
- attack.t1552.001
- attack.t1552
- attack.t1083
- attack.t1213
logsource:
category: webserver
detection:
selection_maintenance_uri:
cs-uri-stem|contains:
- '/ismaintenance/'
- '/ismsnap'
- '/ism/ismaintenance'
- '/ism/snapshot'
- '/maintenance/ismsnap'
- '/ism/backup'
- '/ism/log'
selection_download_method:
cs-method:
- GET
- POST
selection_file_access:
TargetFilename|contains:
- '\\ismsnap\\'
- '/ismsnap/'
- '\\ISM\\maintenance\\'
- '/ISM/maintenance/'
filter_legitimate_admin:
c-ip|cidr:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
condition: (selection_maintenance_uri and selection_download_method) or selection_file_access
fields:
- c-ip
- cs-method
- cs-uri-stem
- cs-user-agent
- sc-status
- sc-bytes
- TargetFilename
falsepositives:
- Legitimate administrator accessing ISM maintenance functions from internal management network
- Scheduled ISM backup or maintenance tasks generating ismsnap data
- Monitoring tools checking ISM health endpoints
level: medium
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →