Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Potential Ivanti CSA Path Traversal Exploitation CVE-2024-8963
id: 3f2a7fc0-c822-40c2-a414-51a23114a475
status: experimental
description: |
Detects potential exploitation of CVE-2024-8963, a path traversal vulnerability in Ivanti Cloud Services Application (CSA).
Attackers use encoded "../" sequences in HTTP requests to escape the web root and read arbitrary files.
This rule looks for characteristic path traversal patterns in HTTP URIs targeting Ivanti CSA endpoints.
Note: This rule is a starting point — tune for your environment.
references:
- https://www.cisa.gov/news-events/alerts/2024/10/03/cisa-adds-one-known-exploited-vulnerability-catalog
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-Path-Traversal-CVE-2024-8963
- https://www.rapid7.com/blog/post/2024/10/04/etr-cve-2024-8963-ivanti-cloud-services-application-csa-path-traversal/
author: SARA Detection Engineering
date: 2026-08-15
tags:
- attack.t1190
- attack.initial_access
logsource:
category: webserver
product: ""
detection:
selection_traversal:
cs-uri-query|contains:
- "%2f..%2f"
- "%2F..%2F"
- "/..%2f"
- "%2f../"
- "..%2f..%2f"
- "..%5c..%5c"
- "/..%5c"
filter_legitimate_scanners:
cs-user-agent|contains:
- "Qualys"
- "Nessus"
- "Tenable"
- "Rapid7"
condition: selection_traversal and not filter_legitimate_scanners
fields:
- c-ip
- cs-method
- cs-uri-query
- cs-user-agent
- sc-status
falsepositives:
- Legitimate vulnerability scanners running authorized assessments against the CSA management interface.
- Misconfigured load balancers or reverse proxies appending unexpected path segments.
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →