From fd93bb57110ecfe62a60b6754d53ad98802ee24c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 12 Oct 2023 09:09:03 -0600 Subject: [PATCH 1/3] Update citrix_adc_exploitation_cve_2023_3519.yml --- detections/web/citrix_adc_exploitation_cve_2023_3519.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml index ae8de91722..5f016016c3 100644 --- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml +++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml @@ -14,7 +14,7 @@ description: This analytic is designed to assist in hunting for potential exploi Please be aware that this analytic is based on current understanding of the vulnerability, and adjustments may be required as more information becomes available. search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("*/saml/login","/cgi/samlauth","*/saml/activelogin","/cgi/samlart?samlart=*","*/cgi/logout") Web.http_method=POST + as lastTime from datamodel=Web where Web.url IN ("*/saml/login","/cgi/samlauth","*/saml/activelogin","/cgi/samlart?samlart=*","*/cgi/logout","/gwtest/formssso?event=start&target=*","/netscaler/ns_gui/vpn/*") Web.http_method=POST by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` @@ -26,6 +26,8 @@ known_false_positives: False positives may be present based on organization use references: - https://blog.assetnote.io/2023/07/21/citrix-CVE-2023-3519-analysis/ - https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467 +- https://securityintelligence.com/x-force/x-force-uncovers-global-netscaler-gateway-credential-harvesting-campaign/ +- https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967 tags: analytic_story: - Citrix Netscaler ADC CVE-2023-3519 From 9817a13daf9224fbf35396b118355e376256088d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 12 Oct 2023 09:10:58 -0600 Subject: [PATCH 2/3] Update confluence_data_center_and_server_privilege_escalation.yml --- .../confluence_data_center_and_server_privilege_escalation.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/web/confluence_data_center_and_server_privilege_escalation.yml b/detections/web/confluence_data_center_and_server_privilege_escalation.yml index 6ff4c1c8e5..0f871b5917 100644 --- a/detections/web/confluence_data_center_and_server_privilege_escalation.yml +++ b/detections/web/confluence_data_center_and_server_privilege_escalation.yml @@ -20,6 +20,7 @@ known_false_positives: False positives may be present with legitimate applicatio references: - https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html - https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/ + - https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis tags: analytic_story: - CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server From 74b95a14005d395d17ebb96db981449d43eaa35c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 13 Oct 2023 07:06:16 -0600 Subject: [PATCH 3/3] Update citrix_adc_exploitation_cve_2023_3519.yml --- detections/web/citrix_adc_exploitation_cve_2023_3519.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml index 5f016016c3..532fb9f897 100644 --- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml +++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml @@ -1,6 +1,6 @@ name: Citrix ADC Exploitation CVE-2023-3519 id: 76ac2dcb-333c-4a77-8ae9-2720cfae47a8 -version: 1 +version: 2 date: '2023-07-21' author: Michael Haag, Splunk status: production