From 2566899c76c378c9eaa15515874148e6d56ed8e8 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 3 Oct 2022 13:01:30 -0500 Subject: [PATCH 1/2] #2398 fix --- .../splunk_account_discovery_drilldown_dashboard_disclosure.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml b/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml index 2aa47bbf0e..268a9cf325 100644 --- a/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml +++ b/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml @@ -5,7 +5,7 @@ date: '2022-08-02' author: Marissa Bower, Rod Soto, Splunk type: TTP datamodel: [] -search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_drilldown_dashboard_disclosure_filter`' +search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_account_discovery_drilldown_dashboard_disclosure_filter`' description: Splunk drilldown vulnerability disclosure in Dashboard application that can potentially allow exposure of tokens from privilege users. An attacker can create dashboard and share it to privileged user (admin) and detokenize variables using external urls within dashboards drilldown function. how_to_implement: This search uses REST function to query for dashboards with environment variables present in URL options. known_false_positives: This search may reveal non malicious URLs with environment variables used in organizations. From 83850b8b59452b133d57226c464af6d4af88d379 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 3 Oct 2022 13:01:57 -0500 Subject: [PATCH 2/2] #2402 fix --- .../experimental/network/remote_desktop_network_traffic.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml index 23404f523f..653b7fcc2c 100644 --- a/detections/experimental/network/remote_desktop_network_traffic.yml +++ b/detections/experimental/network/remote_desktop_network_traffic.yml @@ -13,7 +13,7 @@ description: This search looks for network traffic on TCP/3389, the default port on your network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND - All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source + All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source AND all_Traffic.action="allowed" by All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_desktop_network_traffic_filter` ' how_to_implement: To successfully implement this search you need to identify systems