From ef63dc97e1df8b61118437d68d09e263b21ddf23 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Thu, 13 Jul 2023 16:23:43 -0700
Subject: [PATCH 01/14] 1bh

---
 ...nticated_log_injection_web_service_log.yml | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 detections/application/splunk_unauthenticated_log_injection_web_service_log.yml

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
new file mode 100644
index 0000000000..f6bc29b3a9
--- /dev/null
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -0,0 +1,47 @@
+name: Splunk unauthenticated log injection web service log
+id: de3908dc-1298-446d-84b9-fa81d37e959b
+version: 1
+date: '2023-07-13'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- UPDATE_DATA_SOURCE
+description: UPDATE_DESCRIPTION
+search: index=_internal source="/opt/splunk/var/log/splunk/web_access.log" method=GET
+  OR method=POST OR method=PUT OR method=HEAD uri_path=*\x1B* OR *\u001b* OR *\033*
+  OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`
+how_to_implement: UPDATE_HOW_TO_IMPLEMENT
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+- REFERENCE
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  asset_type: UPDATE asset_type
+  atomic_guid:
+  - UPDATE atomic_guid
+  confidence: UPDATE value between 1-100
+  impact: UPDATE value between 1-100
+  message: UPDATE message
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: UPDATE
+    type: UPDATE
+    role:
+    - UPDATE
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: UPDATE (impact * confidence)/100
+  required_fields:
+  - UPDATE_required_fields
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: UPDATE url to dataset
+    source: UPDATE source
+    sourcetype: UPDATE sourcetype

From 170779311db7d3ca4eeed5214d1a76c0085720d3 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Thu, 13 Jul 2023 16:44:51 -0700
Subject: [PATCH 02/14] 2bh

---
 ...nticated_log_injection_web_service_log.yml | 48 ++++++++++---------
 1 file changed, 26 insertions(+), 22 deletions(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index f6bc29b3a9..9d894b2b91 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -6,42 +6,46 @@ author: Rod Soto
 status: production
 type: Hunting
 data_source:
-- UPDATE_DATA_SOURCE
-description: UPDATE_DESCRIPTION
-search: index=_internal source="/opt/splunk/var/log/splunk/web_access.log" method=GET
-  OR method=POST OR method=PUT OR method=HEAD uri_path=*\x1B* OR *\u001b* OR *\033*
-  OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`
-how_to_implement: UPDATE_HOW_TO_IMPLEMENT
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+- 
+description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute.
+search: index=_internal source="/opt/splunk/var/log/splunk/web_access.log" method=GET OR method=POST OR method=PUT OR method=HEAD uri_path=*\x1B* OR *\u001b* OR *\033* OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`
+how_to_implement: This only affects web enabled Splunk instances. 
+known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voulntarily or by accident. This search will not detect obfuscated ANSI characters. 
 references:
-- REFERENCE
+- https://research.splunk.com 
+- https://advisory.splunk.com/advisories/SVD-2023-0606 
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
-  asset_type: UPDATE asset_type
-  atomic_guid:
-  - UPDATE atomic_guid
-  confidence: UPDATE value between 1-100
-  impact: UPDATE value between 1-100
-  message: UPDATE message
+  - Splunk Vulnerabilities
+  asset_type: Enpoint
+  confidence: 30
+  impact: 30
+  cve: cve-2023-32712
+  message: Possible exploitation attempt against $host
   mitre_attack_id:
   - T1190
   observable:
-  - name: UPDATE
-    type: UPDATE
+  - name: host
+    type: host
     role:
-    - UPDATE
+    - victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  risk_score: UPDATE (impact * confidence)/100
+  risk_score: 9
   required_fields:
-  - UPDATE_required_fields
+  - method
+  - uri_path
+  - host 
+  - status 
+  - clientip 
   security_domain: endpoint
 tests:
 - name: True Positive Test
   attack_data:
   - data: UPDATE url to dataset
-    source: UPDATE source
-    sourcetype: UPDATE sourcetype
+    source: /opt/splunk/var/log/splunk/web_access.log
+    custom_index: _internal
+    sourcetype: splunk_web_access
+    update_timestamp: true

From 4db0f1f52f39d7dfbbed01b2e72267f40b74d9b6 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Thu, 13 Jul 2023 16:52:29 -0700
Subject: [PATCH 03/14] 3bh

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 9d894b2b91..a7f7e2a317 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -26,9 +26,9 @@ tags:
   - T1190
   observable:
   - name: host
-    type: host
+    type: Hostname
     role:
-    - victim
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From 6514087bfab0b02ec99e5d1fdb605d4f1fc92847 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Thu, 13 Jul 2023 17:05:56 -0700
Subject: [PATCH 04/14] bh4

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index a7f7e2a317..35cc8ed2c5 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -6,7 +6,7 @@ author: Rod Soto
 status: production
 type: Hunting
 data_source:
-- 
+- []
 description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute.
 search: index=_internal source="/opt/splunk/var/log/splunk/web_access.log" method=GET OR method=POST OR method=PUT OR method=HEAD uri_path=*\x1B* OR *\u001b* OR *\033* OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`
 how_to_implement: This only affects web enabled Splunk instances. 
@@ -43,7 +43,7 @@ tags:
   security_domain: endpoint
 tests:
 - name: True Positive Test
-  attack_data:
+  attack_data: 
   - data: UPDATE url to dataset
     source: /opt/splunk/var/log/splunk/web_access.log
     custom_index: _internal

From fb13d95e4a646c82b9f98c90bf46894663f7cc68 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Thu, 13 Jul 2023 17:42:22 -0700
Subject: [PATCH 05/14] 5bh

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 35cc8ed2c5..00ac9fe8c2 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -8,7 +8,7 @@ type: Hunting
 data_source:
 - []
 description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute.
-search: index=_internal source="/opt/splunk/var/log/splunk/web_access.log" method=GET OR method=POST OR method=PUT OR method=HEAD uri_path=*\x1B* OR *\u001b* OR *\033* OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`
+search: '`splunkd_webx` method=GET OR method=POST OR method=PUT OR method=HEAD uri_path=*\x1B* OR *\u001b* OR *\033* OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
 how_to_implement: This only affects web enabled Splunk instances. 
 known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voulntarily or by accident. This search will not detect obfuscated ANSI characters. 
 references:
@@ -44,7 +44,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data: 
-  - data: UPDATE url to dataset
+  - data: []
     source: /opt/splunk/var/log/splunk/web_access.log
     custom_index: _internal
     sourcetype: splunk_web_access

From 8c9bcf49b476189a195adae6da8dce75acd0950d Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Thu, 13 Jul 2023 18:06:10 -0700
Subject: [PATCH 06/14] 6bh

---
 ...k_unauthenticated_log_injection_web_service_log.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 00ac9fe8c2..2d2ad86e98 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -6,9 +6,9 @@ author: Rod Soto
 status: production
 type: Hunting
 data_source:
-- []
+- http://127.0.0.1:8080/tr-3113.txt
 description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute.
-search: '`splunkd_webx` method=GET OR method=POST OR method=PUT OR method=HEAD uri_path=*\x1B* OR *\u001b* OR *\033* OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
+search: '`splunkd_webx` uri_path=*\x1B* OR *\u001b* OR *\033* OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
 how_to_implement: This only affects web enabled Splunk instances. 
 known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voulntarily or by accident. This search will not detect obfuscated ANSI characters. 
 references:
@@ -17,11 +17,11 @@ references:
 tags:
   analytic_story:
   - Splunk Vulnerabilities
-  asset_type: Enpoint
+  asset_type: Endpoint
   confidence: 30
   impact: 30
-  cve: cve-2023-32712
   message: Possible exploitation attempt against $host
+  cve: cve-2023-32712
   mitre_attack_id:
   - T1190
   observable:
@@ -44,7 +44,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data: 
-  - data: []
+  - data: http://127.0.0.1:8080/tr-3113.txt
     source: /opt/splunk/var/log/splunk/web_access.log
     custom_index: _internal
     sourcetype: splunk_web_access

From c1188551d2064e82cf021dc6c0e3609aebdd41ba Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Fri, 14 Jul 2023 17:55:29 -0700
Subject: [PATCH 07/14] 6bh

---
 ...unauthenticated_log_injection_web_service_log.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 2d2ad86e98..63a079e4fd 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -5,10 +5,9 @@ date: '2023-07-13'
 author: Rod Soto
 status: production
 type: Hunting
-data_source:
-- http://127.0.0.1:8080/tr-3113.txt
+data_source: []
 description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute.
-search: '`splunkd_webx` uri_path=*\x1B* OR *\u001b* OR *\033* OR *\0x9* OR *\0x8* | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
+search: '`splunkd_webx`  uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
 how_to_implement: This only affects web enabled Splunk instances. 
 known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voulntarily or by accident. This search will not detect obfuscated ANSI characters. 
 references:
@@ -21,7 +20,8 @@ tags:
   confidence: 30
   impact: 30
   message: Possible exploitation attempt against $host
-  cve: cve-2023-32712
+  cve: 
+  - cve-2023-32712
   mitre_attack_id:
   - T1190
   observable:
@@ -44,8 +44,8 @@ tags:
 tests:
 - name: True Positive Test
   attack_data: 
-  - data: http://127.0.0.1:8080/tr-3113.txt
+  - data: 
     source: /opt/splunk/var/log/splunk/web_access.log
     custom_index: _internal
     sourcetype: splunk_web_access
-    update_timestamp: true
+    

From 387c4bd2e2866717e1154d062dfeb262e7d6618c Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Fri, 14 Jul 2023 18:01:32 -0700
Subject: [PATCH 08/14] 7bh

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 63a079e4fd..57133a2f8d 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -1,4 +1,4 @@
-name: Splunk unauthenticated log injection web service log
+name: Splunk Unauthenticated Log Injection Web Service Log
 id: de3908dc-1298-446d-84b9-fa81d37e959b
 version: 1
 date: '2023-07-13'

From 29bf8975ebb533b4ac47b50732985ca224de612f Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Mon, 31 Jul 2023 08:05:51 -0700
Subject: [PATCH 09/14] addeddollarsign

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 57133a2f8d..4a6ce6c1a3 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -19,7 +19,7 @@ tags:
   asset_type: Endpoint
   confidence: 30
   impact: 30
-  message: Possible exploitation attempt against $host
+  message: Possible exploitation attempt against $host$
   cve: 
   - cve-2023-32712
   mitre_attack_id:

From 59e5d6da72460ec7fdd6acebb8e3e2517c4c5908 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Mon, 31 Jul 2023 08:18:50 -0700
Subject: [PATCH 10/14] typos

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 4a6ce6c1a3..926759f1f1 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -9,7 +9,7 @@ data_source: []
 description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute.
 search: '`splunkd_webx`  uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
 how_to_implement: This only affects web enabled Splunk instances. 
-known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voulntarily or by accident. This search will not detect obfuscated ANSI characters. 
+known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voluntarily or by accident. This search will not detect obfuscated ANSI characters. 
 references:
 - https://research.splunk.com 
 - https://advisory.splunk.com/advisories/SVD-2023-0606 
@@ -21,7 +21,7 @@ tags:
   impact: 30
   message: Possible exploitation attempt against $host$
   cve: 
-  - cve-2023-32712
+  - CVE-2023-32712
   mitre_attack_id:
   - T1190
   observable:

From e5b9e9437b4a9e0dd14275d2d6b915effff02366 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Mon, 31 Jul 2023 08:32:33 -0700
Subject: [PATCH 11/14] fixes2

---
 ...plunk_unauthenticated_log_injection_web_service_log.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 926759f1f1..ce8e8f7a90 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -8,10 +8,9 @@ type: Hunting
 data_source: []
 description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute.
 search: '`splunkd_webx`  uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
-how_to_implement: This only affects web enabled Splunk instances. 
+how_to_implement: This only affects web enabled Splunk instances. The detection does require the ability to search the _internal index.
 known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voluntarily or by accident. This search will not detect obfuscated ANSI characters. 
 references:
-- https://research.splunk.com 
 - https://advisory.splunk.com/advisories/SVD-2023-0606 
 tags:
   analytic_story:
@@ -19,7 +18,7 @@ tags:
   asset_type: Endpoint
   confidence: 30
   impact: 30
-  message: Possible exploitation attempt against $host$
+  message: Possible Splunk unauthenticated log injection web service log exploitation attempt against $host$ from $clientip$
   cve: 
   - CVE-2023-32712
   mitre_attack_id:
@@ -44,7 +43,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data: 
-  - data: 
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/web_access.log
     source: /opt/splunk/var/log/splunk/web_access.log
     custom_index: _internal
     sourcetype: splunk_web_access

From 908e686283c54b12c9bf871a3cc9bee3a765d6d2 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Mon, 31 Jul 2023 08:36:43 -0700
Subject: [PATCH 12/14] morefixes

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml  | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index ce8e8f7a90..1ec36e8d9b 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -28,6 +28,10 @@ tags:
     type: Hostname
     role:
     - Victim
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From d3806e5a355ca50d9e1a7c84a663e7beec1afec9 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 31 Jul 2023 08:59:56 -0700
Subject: [PATCH 13/14] Update
 splunk_unauthenticated_log_injection_web_service_log.yml

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 1ec36e8d9b..372e2c1a35 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -6,7 +6,7 @@ author: Rod Soto
 status: production
 type: Hunting
 data_source: []
-description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute.
+description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute. This following analytic detects potential log injection attempts into the Splunk Server.
 search: '`splunkd_webx`  uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
 how_to_implement: This only affects web enabled Splunk instances. The detection does require the ability to search the _internal index.
 known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voluntarily or by accident. This search will not detect obfuscated ANSI characters. 

From 8a05a0f4c29fc759216b1cdf9791592ee0d7caf0 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 31 Jul 2023 09:02:03 -0700
Subject: [PATCH 14/14] Update
 splunk_unauthenticated_log_injection_web_service_log.yml

---
 .../splunk_unauthenticated_log_injection_web_service_log.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
index 372e2c1a35..1e650e7254 100644
--- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
+++ b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml
@@ -6,7 +6,7 @@ author: Rod Soto
 status: production
 type: Hunting
 data_source: []
-description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute. This following analytic detects potential log injection attempts into the Splunk Server.
+description: An attacker can use a specially crafted web URL in their browser to cause log file injection, in which the attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to successfully execute. This following analytic detects potential log injection attempts into the Splunk server.
 search: '`splunkd_webx`  uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
 how_to_implement: This only affects web enabled Splunk instances. The detection does require the ability to search the _internal index.
 known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voluntarily or by accident. This search will not detect obfuscated ANSI characters.