Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: CVE-2024-35730 Stored XSS Attempt in Maps Marker Pro mmpro_save_marker
id: 2fdc8a2e-4dd3-498d-ba74-880700211f68
date: 2026-09-11
status: experimental
description: |
Detects exploitation of CVE-2024-35730, a Stored XSS vulnerability in the
WordPress plugin "Maps Marker Pro (Google Maps Plugin)" by realmag777
(versions through 4.3.1, CVSS 7.1, not in CISA KEV). An authenticated
contributor+ user submits an XSS payload to wp-admin/admin-ajax.php via
the action=mmpro_save_marker parameter, targeting marker name/description
fields. The payload is stored and later rendered when an admin views the
marker list. This rule is a starting point — tune for your environment,
especially expected legitimate marker-edit activity by trusted editors.
references:
- https://patchstack.com/database/vulnerability/_40847
- https://nvd.nist.gov/vuln/detail/CVE-2024-35730
- https://www.cve.org/CVERecord?id=CVE-2024-35730
author: SARA Detection Engineering
tags:
- attack.t1059.007
- attack.t1190
- attack.t1068
logsource:
category: webserver
product: ''
detection:
selection_endpoint:
cs-method: POST
cs-uri-stem|endswith: /wp-admin/admin-ajax.php
cs-uri-query|contains:
- action=mmpro_save_marker
- action=mmpro_edit_marker
selection_xss_payload:
cs-uri-query|contains:
- '<script'
- 'javascript:'
- 'onerror='
- 'onload='
- 'onmouseover='
- 'onfocus='
- '<img src=x'
- '<svg onload'
- '<iframe src'
- 'alert('
- 'document.cookie'
- 'prompt('
- 'String.fromCharCode'
- 'eval('
selection_body_marker:
# Body content is not always captured by webserver logs; if available
# via c-body / cs-body field, match marker field names + XSS payload.
cs-body|contains:
- 'marker_name'
- 'marker_description'
- 'mmpro'
filter_legit_admin:
cs-user-agent|contains:
- 'WordPress/'
- 'wp-admin'
condition: selection_endpoint and (selection_xss_payload or selection_body_marker) and not filter_legit_admin
fields:
- c-ip
- cs-method
- cs-uri-stem
- cs-uri-query
- cs-user-agent
- cs-username
- sc-status
- cs-body
falsepositives:
- Legitimate Maps Marker Pro editors adding marker content with HTML (rare — most editors do not paste raw <script> tags)
- Security scanner / pentest activity against the WordPress instance
- WAF false-positive on encoded HTML in marker description fields
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →