terge branch 'vj9r' of github.com:splunk/security_content into vj9r

detections/application/splunk_digital_certificates_infrastructure_version.yml

@@ -0,0 +1,48 @@
+name: Splunk Digital Certificates Infrastructure Version
+id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7
+version: 1
+date: '2022-05-26'
+author: Lou Stella, Splunk
+type: Hunting
+datamodel: []
+description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. 
+search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`'
+how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers.
+known_false_positives: No known at this time.
+references:
+- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: $splunk_server$ may not be properly validating TLS Certificates
+  mitre_attack_id:
+  - T1587.003
+  nist:
+  - DE.CM
+  observable:
+  - name: splunk_server
+    type: Hostname
+    role:
+    - victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - none
+  risk_score: 50
+  security_domain: threat

detections/application/splunk_process_injection_forwarder_bundle_downloads.yml

@@ -0,0 +1,52 @@
+name: Splunk Process Injection Forwarder Bundle Downloads
+id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e
+version: 1
+date: '2022-05-26'
+author: Lou Stella, Splunk
+type: Hunting
+datamodel: []
+description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment.
+search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`'
+how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment.
+known_false_positives: None at this time.
+references:
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilites
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: $peer$ downloaded apps from $host$
+  mitre_attack_id:
+  - T1055
+  nist:
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - component
+  - app
+  - serverclass
+  - peer 
+  - host
+  risk_score: 35
+  security_domain: threat

detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml

@@ -11,6 +11,7 @@ how_to_implement: The user running this search is required to have a permission
 known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration.
 references:
 - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html
 tags:
   analytic_story:
   - Splunk Vulnerabilities
@@ -34,7 +35,7 @@ tags:
   - DE.CM
   observable:
   - name: splunk_server
-    type: hostname
+    type: Hostname
     role:
     - victim
   product:

tests/application/splunk_digital_certificates_infrastructure_version.test.yml

@@ -0,0 +1,13 @@
+name: Splunk Digital Certificates Infrastructure Version Unit Test
+tests:
+- name: Splunk Digital Certificates Infrastructure Version
+  file: application/splunk_digital_certificates_infrastructure_version.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
+    source: audittrail
+    sourcetype: audittrail
+    update_timestamp: true

tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml

@@ -0,0 +1,13 @@
+name: Splunk Process Injection Forwarder Bundle Downloads Unit Test
+tests:
+- name: Splunk Process Injection Forwarder Bundle Downloads
+  file: application/splunk_process_injection_forwarder_bundle_downloads.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: splunkd.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log
+    source: "/opt/splunk/var/log/splunk/splunkd.log"
+    sourcetype: splunkd
+    update_timestamp: false