From e6c5fbd10161fa8fe3669c26c6a8f636da5e68a1 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 14 Feb 2023 06:46:13 -0800
Subject: [PATCH 1/6] added all detections for release, still need to update
 dataset links

---
 ...srf_in_the_ssg_kvstore_client_endpoint.yml | 54 ++++++++++++++++
 ...ly_formatted_parameter_crashes_splunkd.yml | 57 +++++++++++++++++
 ...rapiddiag_through_user_interface_views.yml | 56 +++++++++++++++++
 ..._command_abuse_disclosed_february_2023.yml | 62 +++++++++++++++++++
 ...nsions_allowed_by_lookup_table_uploads.yml | 61 ++++++++++++++++++
 .../application/splunk_xss_via_view.yml       | 50 +++++++++++++++
 ...nk_list_all_nonstandard_admin_accounts.yml | 57 +++++++++++++++++
 lookups/splunk_risky_command.csv              | 11 ++++
 lookups/splunk_risky_command.yml              |  7 +++
 ...n_the_ssg_kvstore_client_endpoint.test.yml | 14 +++++
 ...rmatted_parameter_crashes_splunkd.test.yml | 13 ++++
 ...diag_through_user_interface_views.test.yml | 13 ++++
 ...and_abuse_disclosed_february_2023.test.yml | 13 ++++
 ...s_allowed_by_lookup_table_uploads.test.yml | 14 +++++
 .../application/splunk_xss_via_view.test.yml  | 13 ++++
 15 files changed, 495 insertions(+)
 create mode 100644 detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
 create mode 100644 detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml
 create mode 100644 detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
 create mode 100644 detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
 create mode 100644 detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
 create mode 100644 detections/application/splunk_xss_via_view.yml
 create mode 100644 detections/experimental/application/splunk_list_all_nonstandard_admin_accounts.yml
 create mode 100644 lookups/splunk_risky_command.csv
 create mode 100644 lookups/splunk_risky_command.yml
 create mode 100644 tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml
 create mode 100644 tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
 create mode 100644 tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml
 create mode 100644 tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml
 create mode 100644 tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml
 create mode 100644 tests/application/splunk_xss_via_view.test.yml

diff --git a/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml b/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
new file mode 100644
index 0000000000..72436bf866
--- /dev/null
+++ b/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
@@ -0,0 +1,54 @@
+name: Splunk csrf in the ssg kvstore client endpoint
+id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410
+version: 1
+date: "2023-02-14"
+author: Rod Soto
+type: TTP
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the kvstore_client endpoint allows for updating SSG KV store collections via a GET request. SSG is a Splunk Built app included by default with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled. This hunting search provides information on affected server specific method and post data that may reveal exploitation of this vulnerability.
+search: '`splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200"  | table  splunk_server status uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`'
+how_to_implement: Requires access to internal index.
+known_false_positives: This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22942
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - UPDATE_DATASET_URL
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential CSRF exploitation attempt from $host$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: splunk_server
+      type: Hostname
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - splunk_server
+    - status
+    - uri
+    - delete_field_value
+    - method
+    - post_data
+  risk_score: 25
+  security_domain: threat
diff --git a/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml b/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml
new file mode 100644
index 0000000000..73642b9076
--- /dev/null
+++ b/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml
@@ -0,0 +1,57 @@
+name: Splunk Improperly Formatted Parameter Crashes splunkd
+id: 08978eca-caff-44c1-84dc-53f17def4e14
+version: 1
+date: "2023-02-14"
+author: Chase Franklin, Rod Soto, Splunk
+type: TTP
+datamodel:
+  - Endpoint
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, when the INGEST\\_EVAL parameter is improperly formatted, it crashes splunkd. This hunting search provides the user, timing and number of times the crashing command was executed.
+search:
+  '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"
+  AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc
+  Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info
+  Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type
+  | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`'
+how_to_implement: Requires access to audittrail and use of Splunk_Audit.Search_Activity datamodel.
+known_false_positives: This is a hunting search it should be focused on affected products, otherwise it is likely to produce false positives.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22941
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 100
+  context:
+    - Source:Endpoint
+  dataset:
+    - UPDATE_DATASET_URL
+  impact: 100
+  kill_chain_phases:
+    - Exploitation
+  message: An attempt to exploit ingest eval parameter was detected from $user$
+  mitre_attack_id:
+    - T1499
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Attacker
+  product:
+    - Splunk Enterprise
+  required_fields:
+    - user
+    - count
+    - info
+  risk_score: 100
+  security_domain: threat
diff --git a/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml b/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
new file mode 100644
index 0000000000..6dfda06495
--- /dev/null
+++ b/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
@@ -0,0 +1,56 @@
+name: Persistent XSS in RapidDiag through User Interface Views
+id: ce6e1268-e01c-4df2-a617-0f034ed49a43
+version: 1
+date: "2023-02-14"
+author: Rod Soto, Splunk
+type: TTP
+datamodel: []
+description: In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0. This search provides information on what user may have potentially added a malicious payload and what users were exposed to it.
+search:
+  "`audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/*
+  action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`"
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index
+known_false_positives: This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22932
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - UPDATE_DATASET_URL
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: A potential XSS attempt has been detected from $user$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: User
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - user
+    - action
+    - roles
+    - info
+    - roles
+    - path
+  risk_score: 25
+  security_domain: threat
diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
new file mode 100644
index 0000000000..74ac4a90fc
--- /dev/null
+++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
@@ -0,0 +1,62 @@
+name: Splunk risky Command Abuse disclosed february 2023
+id: ee69374a-d27e-4136-adac-956a96ff60fd
+version: 1
+date: "2023-02-14"
+author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
+type: Hunting
+datamodel: []
+description: In February 2023, Splunk disclosed several vulnerabilities affecting Splunk Enterprise commands deemed risky. The following hunting search includes the following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10), pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below 8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more information please review Splunk Vulnerabilities Disclosure, February 2023. Link can be found in reference.
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command as search output splunk_risky_command description vulnerable_versions CVE other_metadata | where splunk_risky_command != "false" | `splunk_risky_command_abuse_disclosed_february_2023_filter`'
+how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel.
+known_false_positives: This search encompasses many commands.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22931
+    - CVE-2023-22934
+    - CVE-2023-22935
+    - CVE-2023-22936
+    - CVE-2023-22939
+    - CVE-2023-22940
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - UPDATE_DATASET_URL
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Use of risky splunk command $splunk_risky_command$ detected by $user$
+  mitre_attack_id:
+    - T1548
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Attacker
+    - name: splunk_risky_command
+      type: Other
+      role:
+        - Other
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - search
+    - info
+    - user
+    - search_type
+    - count
+  risk_score: 25
+  security_domain: threat
diff --git a/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml b/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
new file mode 100644
index 0000000000..e474abc148
--- /dev/null
+++ b/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
@@ -0,0 +1,61 @@
+name: Splunk unnecesary file extensions allowed by lookup table uploads
+id: b7d1293f-e78f-415e-b5f6-443df3480082
+version: 1
+date: "2023-02-14"
+author: Rod Soto, Splunk
+type: TTP
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table uploads let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now only be one of .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gz. This search provides user activity focus on uploads which aims to help hunt for malicious file uploads.
+search:
+  '`splunkda` method IN ("POST", "DELETE") uri_path=/servicesNS/*/ui/views/*
+  | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method=="DELETE" , "Deleted" )
+  | rex field=uri_path "(?<user_and_app>.*?)\/ui\/views/(?<dashboard_encoded>.*)"
+  | eval dashboard = urldecode( dashboard_encoded )
+  | table _time, uri_path, user, dashboard, activity, uri_path
+  | `splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads_filter`'
+how_to_implement: Requires access to internal splunkd_access.
+known_false_positives: This is a hunting search, the search provides information on upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary after executing search. This search will produce false positives as payload cannot be directly discerned.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22937
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - UPDATE_DATASET_URL
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential lookup template injection attempt from $user$ on lookup table at path $uri_path$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: uri_path
+      type: Other
+      role:
+        - Other
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - user
+    - method
+    - uri_path
+  risk_score: 25
+  security_domain: threat
diff --git a/detections/application/splunk_xss_via_view.yml b/detections/application/splunk_xss_via_view.yml
new file mode 100644
index 0000000000..44fc8d1d4a
--- /dev/null
+++ b/detections/application/splunk_xss_via_view.yml
@@ -0,0 +1,50 @@
+name: Splunk XSS via View
+id: 9ac2bfea-a234-4a18-9d37-6d747e85c2e4
+version: 1
+date: "2023-02-07"
+author: Rod Soto, Eric McGinnis, Splunk
+type: Hunting
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled. This hunting search shows users action, application and role used for creating views related to this vulnerability.
+search: index = _internal sourcetype IN ("splunk_web_service", "splunk_python") message="*loadParams*" | `security_content_ctime(_time)` |  table _time message fileName | `splunk_xss_via_view_filter`
+how_to_implement: This data is collected by default in Splunk.  Upon first enabling this rule, a number of errors may be observed. Those that are due to improperly formatted, but non-nefarious, XML views should be be remedied in the corresponding view. Please take care investigating potential XSS as accessing an affected page could retrigger the exploit.
+known_false_positives: The error detected above can be generated for a wide variety of improperly formatted XML views.  There will be false positives as the search cannot extract the malicious payload and the view should be manually investigated.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22933
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - N/A
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential stored XSS attempt via $fileName$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: fileName
+      type: URL
+      role:
+        - Target
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - message
+    - fileName
+  risk_score: 25
+  security_domain: endpoint
diff --git a/detections/experimental/application/splunk_list_all_nonstandard_admin_accounts.yml b/detections/experimental/application/splunk_list_all_nonstandard_admin_accounts.yml
new file mode 100644
index 0000000000..98ea46f515
--- /dev/null
+++ b/detections/experimental/application/splunk_list_all_nonstandard_admin_accounts.yml
@@ -0,0 +1,57 @@
+name: Splunk list all nonstandard admin accounts
+id: 401d689c-8596-4c6b-a710-7b6fdca296d3
+version: 1
+date: "2023-02-07"
+author: Rod Soto
+type: Hunting
+datamodel: []
+description: "This search will enumerate all Splunk Accounts with administrative
+  rights on this instance.  It deliberately ignores the default admin account since
+  this is assumed to be present.  This search may help in a detection the Cross-Site
+  Scripting Attack listed: In Splunk Enterprise versions below 8.1.13, 8.2.10, and
+  9.0.4, a View allows for Cross-Site Scripting in an XML View through the
+  'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled."
+search:
+  "| rest splunk_server=local /services/authentication/users |search capabilities=admin*
+  OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server
+  | `splunk_list_all_nonstandard_admin_accounts_filter`"
+how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures.  If there have been admin account, in addition to the standard admin account, intentionally created on this server, then edit the filter macro to exclude them.
+known_false_positives: It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above.  If a user is not believed to be legitimate, then further investigation should take place.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22933
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential stored XSS attempt from $host$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: splunk_server
+      type: Hostname
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - capabilities
+    - splunk_server
+    - title
+  risk_score: 25
+  security_domain: endpoint
diff --git a/lookups/splunk_risky_command.csv b/lookups/splunk_risky_command.csv
new file mode 100644
index 0000000000..b7d885aa5b
--- /dev/null
+++ b/lookups/splunk_risky_command.csv
@@ -0,0 +1,11 @@
+splunk_risky_command,description,vulnerable_versions,CVE,other_metadata
+*createrss*,createrss command overwrites existing RSS feeds without verifying permissions, 8.1.13 8.2.10,CVE-2023-22931
+*pivot?seedSid=*,pivot command allows a search to bypass SPL safeguards for risky commands using a saved job,8.1.13,8.2.10,9.0.4,CVE-2023-22934
+*|makeresults+&search_listener*,search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user,8.1.13 8.2.10 9.0.4,CVE-2023-22936
+*| map search=*| *,map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands,8.1.13 8.2.10 9.0.4,CVE-2023-22939
+*|mcollect%20index*" ,collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*meventcollect*" ,collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*summaryindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*sumindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*stash*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*| sendalert *,display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation,8.1.13 8.2.10 9.0.4,CVE-2023-22935
diff --git a/lookups/splunk_risky_command.yml b/lookups/splunk_risky_command.yml
new file mode 100644
index 0000000000..35411eeef0
--- /dev/null
+++ b/lookups/splunk_risky_command.yml
@@ -0,0 +1,7 @@
+description: A list of Risky Splunk Command that are candidates for abuse
+filename: splunk_risky_command.csv
+name: splunk_risky_command
+default_match: 'false'
+match_type: WILDCARD(splunk_risky_command)
+min_matches: 1
+case_sensitive_match: 'false'
diff --git a/tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml b/tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml
new file mode 100644
index 0000000000..c4a207d676
--- /dev/null
+++ b/tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml
@@ -0,0 +1,14 @@
+name: Splunk csrf in the ssg kvstore client endpoint Unit Test
+tests:
+  - name: Splunk csrf in the ssg kvstore client endpoint
+
+    file: "application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml"
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.yml
+        data: http://localhost:9999/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
+        source: splunkd_access.log
+        sourcetype: splunkd_access
+        custom_index: _internal
diff --git a/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml b/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
new file mode 100644
index 0000000000..1129f66c86
--- /dev/null
+++ b/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
@@ -0,0 +1,13 @@
+name: Splunk improperly formatted ingest eval parameter crashes splunkd Unit Test
+tests:
+  - name: Splunk improperly formatted ingest eval parameter crashes splunkd
+    file: application/splunk_improperly_formatted_parameter_crashes_splunkd.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
+        data: http://localhost:9999/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
+        source: splunkd_ui_access.log
+        sourcetype: splunkd_ui_access
+        custom_index: _internal
diff --git a/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml b/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml
new file mode 100644
index 0000000000..0b312a34da
--- /dev/null
+++ b/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml
@@ -0,0 +1,13 @@
+name: Splunk Persistent XSS in RapidDiag through User Interface Views Unit Test
+tests:
+  - name: Splunk Persistent XSS in RapidDiag through User Interface Views
+    file: application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
+        data: http://localhost:9999/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
+        source: audittrail
+        sourcetype: audittrail
+        custom_index: _audit
diff --git a/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml b/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml
new file mode 100644
index 0000000000..425f98048f
--- /dev/null
+++ b/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml
@@ -0,0 +1,13 @@
+name: Splunk risky command abuse disclosed february 2023 Unit Test
+tests:
+  - name: Splunk risky command abuse disclosed february 2023
+    file: application/splunk_risky_command_abuse_disclosed_february_2023.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_createrss_command_abuse.log
+        data: http://localhost:9999/splunk_createrss_command_abuse.log
+        source: audittrail
+        sourcetype: audittrail
+        custom_index: _audit
diff --git a/tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml b/tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml
new file mode 100644
index 0000000000..a654ee1617
--- /dev/null
+++ b/tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml
@@ -0,0 +1,14 @@
+name: Splunk unnecesary file extensions allowed by lookup table uploads Unit Test
+tests:
+- name: Splunk unnecesary file extensions allowed by lookup table uploads
+  file: application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads_data.txt
+    data: http://localhost:9999/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
+    custom_index: _internal
+    source: /opt/splunk/var/log/splunk/splunkd_access.log
+    sourcetype: splunkd_access
+
diff --git a/tests/application/splunk_xss_via_view.test.yml b/tests/application/splunk_xss_via_view.test.yml
new file mode 100644
index 0000000000..ae1ed4dcb6
--- /dev/null
+++ b/tests/application/splunk_xss_via_view.test.yml
@@ -0,0 +1,13 @@
+name: Splunk XSS via View
+tests:
+  - name: Splunk Stored XSS via view module tag layoutPanel attribute
+    file: application/splunk_xss_via_view.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_xss_via_view.log
+        data: http://localhost:9999/splunk_xss_via_view.log
+        source: /opt/splunk/var/log/splunk/web_service.log
+        sourcetype: splunk_web_service
+        custom_index: _internal

From 9d595cf4517d0f1ccf43f7577568c0f816b0ff9b Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 14 Feb 2023 08:21:48 -0800
Subject: [PATCH 2/6] added dataset links

---
 ...srf_in_the_ssg_kvstore_client_endpoint.yml |  2 +-
 ...ly_formatted_parameter_crashes_splunkd.yml |  2 +-
 ...rapiddiag_through_user_interface_views.yml |  2 +-
 ..._command_abuse_disclosed_february_2023.yml |  2 +-
 ...nsions_allowed_by_lookup_table_uploads.yml |  2 +-
 .../application/splunk_xss_via_view.yml       |  2 +-
 ...n_the_ssg_kvstore_client_endpoint.test.yml |  3 +--
 ...rmatted_parameter_crashes_splunkd.test.yml |  2 +-
 ...diag_through_user_interface_views.test.yml |  2 +-
 ...and_abuse_disclosed_february_2023.test.yml |  2 +-
 ...s_allowed_by_lookup_table_uploads.test.yml | 23 +++++++++----------
 .../application/splunk_xss_via_view.test.yml  |  2 +-
 12 files changed, 22 insertions(+), 24 deletions(-)

diff --git a/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml b/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
index 72436bf866..4b91955b91 100644
--- a/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
+++ b/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
@@ -25,7 +25,7 @@ tags:
   context:
     - Source:Endpoint
   dataset:
-    - UPDATE_DATASET_URL
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
   impact: 50
   kill_chain_phases:
     - Exploitation
diff --git a/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml b/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml
index 73642b9076..458cc18e5b 100644
--- a/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml
+++ b/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml
@@ -33,7 +33,7 @@ tags:
   context:
     - Source:Endpoint
   dataset:
-    - UPDATE_DATASET_URL
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
   impact: 100
   kill_chain_phases:
     - Exploitation
diff --git a/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml b/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
index 6dfda06495..a69ae16a8d 100644
--- a/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
+++ b/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
@@ -27,7 +27,7 @@ tags:
   context:
     - Source:Endpoint
   dataset:
-    - UPDATE_DATASET_URL
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
   impact: 50
   kill_chain_phases:
     - Exploitation
diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
index 74ac4a90fc..20ad10b8d1 100644
--- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
@@ -30,7 +30,7 @@ tags:
   context:
     - Source:Endpoint
   dataset:
-    - UPDATE_DATASET_URL
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log
   impact: 50
   kill_chain_phases:
     - Exploitation
diff --git a/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml b/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
index e474abc148..799e199c80 100644
--- a/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
+++ b/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
@@ -31,7 +31,7 @@ tags:
   context:
     - Source:Endpoint
   dataset:
-    - UPDATE_DATASET_URL
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
   impact: 50
   kill_chain_phases:
     - Exploitation
diff --git a/detections/application/splunk_xss_via_view.yml b/detections/application/splunk_xss_via_view.yml
index 44fc8d1d4a..75f4d1a08d 100644
--- a/detections/application/splunk_xss_via_view.yml
+++ b/detections/application/splunk_xss_via_view.yml
@@ -25,7 +25,7 @@ tags:
   context:
     - Source:Endpoint
   dataset:
-    - N/A
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log
   impact: 50
   kill_chain_phases:
     - Exploitation
diff --git a/tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml b/tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml
index c4a207d676..ab112b1da1 100644
--- a/tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml
+++ b/tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml
@@ -1,14 +1,13 @@
 name: Splunk csrf in the ssg kvstore client endpoint Unit Test
 tests:
   - name: Splunk csrf in the ssg kvstore client endpoint
-
     file: "application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml"
     pass_condition: "| stats count | where count > 0"
     earliest_time: -24h
     latest_time: now
     attack_data:
       - file_name: splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.yml
-        data: http://localhost:9999/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
         source: splunkd_access.log
         sourcetype: splunkd_access
         custom_index: _internal
diff --git a/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml b/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
index 1129f66c86..a85e06ad04 100644
--- a/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
+++ b/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
@@ -7,7 +7,7 @@ tests:
     latest_time: now
     attack_data:
       - file_name: splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
-        data: http://localhost:9999/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
         source: splunkd_ui_access.log
         sourcetype: splunkd_ui_access
         custom_index: _internal
diff --git a/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml b/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml
index 0b312a34da..2e37ce8dfe 100644
--- a/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml
+++ b/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml
@@ -7,7 +7,7 @@ tests:
     latest_time: now
     attack_data:
       - file_name: splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
-        data: http://localhost:9999/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
         source: audittrail
         sourcetype: audittrail
         custom_index: _audit
diff --git a/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml b/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml
index 425f98048f..dc67dca36c 100644
--- a/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml
+++ b/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml
@@ -7,7 +7,7 @@ tests:
     latest_time: now
     attack_data:
       - file_name: splunk_createrss_command_abuse.log
-        data: http://localhost:9999/splunk_createrss_command_abuse.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log
         source: audittrail
         sourcetype: audittrail
         custom_index: _audit
diff --git a/tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml b/tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml
index a654ee1617..ce35c3fe37 100644
--- a/tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml
+++ b/tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml
@@ -1,14 +1,13 @@
 name: Splunk unnecesary file extensions allowed by lookup table uploads Unit Test
 tests:
-- name: Splunk unnecesary file extensions allowed by lookup table uploads
-  file: application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -24h
-  latest_time: now
-  attack_data:
-  - file_name: splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads_data.txt
-    data: http://localhost:9999/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
-    custom_index: _internal
-    source: /opt/splunk/var/log/splunk/splunkd_access.log
-    sourcetype: splunkd_access
-
+  - name: Splunk unnecesary file extensions allowed by lookup table uploads
+    file: application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads_data.txt
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
+        custom_index: _internal
+        source: /opt/splunk/var/log/splunk/splunkd_access.log
+        sourcetype: splunkd_access
diff --git a/tests/application/splunk_xss_via_view.test.yml b/tests/application/splunk_xss_via_view.test.yml
index ae1ed4dcb6..84048007f7 100644
--- a/tests/application/splunk_xss_via_view.test.yml
+++ b/tests/application/splunk_xss_via_view.test.yml
@@ -7,7 +7,7 @@ tests:
     latest_time: now
     attack_data:
       - file_name: splunk_xss_via_view.log
-        data: http://localhost:9999/splunk_xss_via_view.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log
         source: /opt/splunk/var/log/splunk/web_service.log
         sourcetype: splunk_web_service
         custom_index: _internal

From 76792021152768bda680f76ba12ba4692ec93073 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 14 Feb 2023 08:38:07 -0800
Subject: [PATCH 3/6] fixing bad dataset link

---
 ...lunk_improperly_formatted_parameter_crashes_splunkd.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml b/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
index a85e06ad04..1e645ff860 100644
--- a/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
+++ b/tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml
@@ -7,7 +7,7 @@ tests:
     latest_time: now
     attack_data:
       - file_name: splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
         source: splunkd_ui_access.log
         sourcetype: splunkd_ui_access
         custom_index: _internal

From eb124998c7b09d0f7deacb5e768c7d8c70b96c29 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 14 Feb 2023 08:46:33 -0800
Subject: [PATCH 4/6] fixed name

---
 ...cessary_file_extensions_allowed_by_lookup_table_uploads.yml} | 2 +-
 ...ry_file_extensions_allowed_by_lookup_table_uploads.test.yml} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename detections/application/{splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml => splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml} (97%)
 rename tests/application/{splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml => splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml} (100%)

diff --git a/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml b/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
similarity index 97%
rename from detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
rename to detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
index 799e199c80..fefd64996a 100644
--- a/detections/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
+++ b/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
@@ -1,4 +1,4 @@
-name: Splunk unnecesary file extensions allowed by lookup table uploads
+name: Splunk unnecessary file extensions allowed by lookup table uploads
 id: b7d1293f-e78f-415e-b5f6-443df3480082
 version: 1
 date: "2023-02-14"
diff --git a/tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml b/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml
similarity index 100%
rename from tests/application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.test.yml
rename to tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml

From 42dd0ae6eda4115acb1092fd4c92405ae011fb11 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 14 Feb 2023 09:06:16 -0800
Subject: [PATCH 5/6] Forgot to change a path in test file

---
 ...ary_file_extensions_allowed_by_lookup_table_uploads.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml b/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml
index ce35c3fe37..bb201fe9f9 100644
--- a/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml
+++ b/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml
@@ -1,7 +1,7 @@
 name: Splunk unnecesary file extensions allowed by lookup table uploads Unit Test
 tests:
   - name: Splunk unnecesary file extensions allowed by lookup table uploads
-    file: application/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.yml
+    file: application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
     pass_condition: "| stats count | where count > 0"
     earliest_time: -24h
     latest_time: now

From 0640489c5096fee2db6ebd787e0a810e31db7700 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 14 Feb 2023 09:17:16 -0800
Subject: [PATCH 6/6] Fixed filter macro name

---
 ...ecessary_file_extensions_allowed_by_lookup_table_uploads.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml b/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
index fefd64996a..eeac80ad2c 100644
--- a/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
+++ b/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
@@ -12,7 +12,7 @@ search:
   | rex field=uri_path "(?<user_and_app>.*?)\/ui\/views/(?<dashboard_encoded>.*)"
   | eval dashboard = urldecode( dashboard_encoded )
   | table _time, uri_path, user, dashboard, activity, uri_path
-  | `splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads_filter`'
+  | `splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter`'
 how_to_implement: Requires access to internal splunkd_access.
 known_false_positives: This is a hunting search, the search provides information on upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary after executing search. This search will produce false positives as payload cannot be directly discerned.
 references: