Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: CVE-2026-8398 Exploitation Attempt Against Ivanti Connect Secure
id: c24f4139-a08f-4860-a20d-aff78363403d
date: 2026-08-15
status: experimental
description: |
Detects exploitation attempts targeting CVE-2026-8398, a critical authentication
bypass vulnerability in Ivanti Connect Secure (ICS) VPN gateways. This CVE is
listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The vulnerability
allows unauthenticated remote attackers to execute arbitrary code by sending
crafted HTTP requests with specific URI patterns and custom headers that bypass
authentication controls. This rule identifies characteristic request patterns
observed in active exploitation including specific URI paths, query parameters,
and header combinations. CVSS 9.8 (Critical). Starting point — tune for your
environment.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-8398
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://forums.ivanti.com/s/article/Security-Advisory-CVE-2026-8398
author: SARA Detection Engineering
tags:
- attack.t1190
- attack.initial_access
logsource:
category: webserver
detection:
selection_uri:
cs-method: POST
cs-uri-stem|contains:
- /dana-na/auth/
- /dana-ws/
- /dana-na/auth/url_default.cgi
cs-uri-query|contains:
- "fake_session_id"
- "tmp_session_id"
- "session_id=../../../"
- "session_id=..%2f..%2f"
selection_headers:
cs-user-agent|contains:
- "Python-urllib"
- "curl"
- "Go-http-client"
- "python-requests"
selection_body:
cs-uri-stem|contains:
- "/dana-na/auth/"
cs-uri-query|contains:
- "cachebuster="
- "rand="
filter_legit:
cs-user-agent|contains:
- "Ivanti"
- "Pulse-Secure"
- "Mozilla/5.0"
sc-status:
- 200
- 302
condition: (selection_uri and selection_headers) or (selection_body and selection_headers) and not filter_legit
falsepositives:
- Legitimate Ivanti health check scripts using curl or Python
- Security scanners performing authorized vulnerability assessments
- Custom automation scripts accessing ICS web interface
level: critical
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →