admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2022-10-03 11:36:11 -07:00
committed by GitHub
parent 50952d511d a2afee2034
commit 01366b645a
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2022-08-02'
author: Marissa Bower, Rod Soto, Splunk
type: TTP
datamodel: []
search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_drilldown_dashboard_disclosure_filter`'
search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_account_discovery_drilldown_dashboard_disclosure_filter`'
description: Splunk drilldown vulnerability disclosure in Dashboard application that can potentially allow exposure of tokens from privilege users. An attacker can create dashboard and share it to privileged user (admin) and detokenize variables using external urls within dashboards drilldown function.
how_to_implement: This search uses REST function to query for dashboards with environment variables present in URL options.
known_false_positives: This search may reveal non malicious URLs with environment variables used in organizations.
detections/experimental/network/remote_desktop_network_traffic.yml
+1 -1
View File
@@ -13,7 +13,7 @@ description: This search looks for network traffic on TCP/3389, the default port
on your network.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND
All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source
All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source AND all_Traffic.action="allowed"
by All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_desktop_network_traffic_filter` '
how_to_implement: To successfully implement this search you need to identify systems