From a766811c5661a13719218e0b108826eabd2affe7 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 10:32:09 -0500 Subject: [PATCH 1/5] 0602 hunt --- ...al_certificates_infrastructure_version.yml | 47 +++++++++++++++++++ ...rtificates_infrastructure_version.test.yml | 13 +++++ 2 files changed, 60 insertions(+) create mode 100644 detections/application/splunk_digital_certificates_infrastructure_version.yml create mode 100644 tests/application/splunk_digital_certificates_infrastructure_version.test.yml diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml new file mode 100644 index 0000000000..5a645b2f29 --- /dev/null +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -0,0 +1,47 @@ +name: Splunk Digital Certificates Infrastructure Version +id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7 +version: 1 +date: '2022-05-26' +author: Lou Stella, Splunk +type: Hunting +datamodel: [] +description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + impact: 50 + kill_chain_phases: + - Exploitation + message: $splunk_server$ may not be properly validating TLS Certificates + mitre_attack_id: + - T1587.003 + nist: + - DE.CM + observable: + - name: splunk_server + type: hostname + role: + - victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - none + risk_score: 50 + security_domain: threat diff --git a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml new file mode 100644 index 0000000000..0e4f63363b --- /dev/null +++ b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml @@ -0,0 +1,13 @@ +name: Splunk Digital Certificates Infrastructure Version Unit Test +tests: +- name: Splunk Digital Certificates Infrastructure Version + file: application/splunk_digital_certificates_infrastructure_version.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true From 44a1886061da1428b3a46cbb6e8b53d43e96e4c4 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 10:32:49 -0500 Subject: [PATCH 2/5] Missing field --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 5a645b2f29..5bea317b56 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -8,7 +8,7 @@ datamodel: [] description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: No known at this time. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication tags: From 92037c5992df5df7590a25a3ce2c4644b760ddd8 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:39:00 -0500 Subject: [PATCH 3/5] deployment server --- ...s_injection_forwarder_bundle_downloads.yml | 52 +++++++++++++++++++ ...ection_forwarder_bundle_downloads.test.yml | 13 +++++ 2 files changed, 65 insertions(+) create mode 100644 detections/application/splunk_process_injection_forwarder_bundle_downloads.yml create mode 100644 tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml new file mode 100644 index 0000000000..17cf657ae4 --- /dev/null +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -0,0 +1,52 @@ +name: Splunk Process Injection Forwarder Bundle Downloads +id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e +version: 1 +date: '2022-05-26' +author: Lou Stella, Splunk +type: Hunting +datamodel: [] +description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' +how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. +known_false_positives: None at this time. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html +tags: + analytic_story: + - Splunk Vulnerabilites + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 75 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log + impact: 50 + kill_chain_phases: + - Exploitation + message: $peer$ downloaded apps from $host$ + mitre_attack_id: + - T1055 + nist: + - DE.CM + observable: + - name: host + type: hostname + role: + - victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - component + - app + - serverclass + - peer + - host + risk_score: 37 + security_domain: threat diff --git a/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml new file mode 100644 index 0000000000..ebe74285c3 --- /dev/null +++ b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml @@ -0,0 +1,13 @@ +name: Splunk Process Injection Forwarder Bundle Downloads Unit Test +tests: +- name: Splunk Process Injection Forwarder Bundle Downloads + file: application/splunk_process_injection_forwarder_bundle_downloads.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splunkd.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd + update_timestamp: false From ef9c0ab6966f03bc2499cccfeacfb77d492c1709 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:40:47 -0500 Subject: [PATCH 4/5] Updated references --- .../splunk_digital_certificates_infrastructure_version.yml | 1 + ...lunk_protocol_impersonation_weak_encryption_configuration.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 5bea317b56..eed19e1c7e 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -11,6 +11,7 @@ how_to_implement: The user running this search is required to have a permission known_false_positives: No known at this time. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index e3f2dfbc9a..7ccd69f476 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -11,6 +11,7 @@ how_to_implement: The user running this search is required to have a permission known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html tags: analytic_story: - Splunk Vulnerabilities From 76f9fe7bbda8b63db349424899653577f5c40364 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:55:26 -0500 Subject: [PATCH 5/5] Updated validation issues --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- .../splunk_process_injection_forwarder_bundle_downloads.yml | 6 +++--- ...protocol_impersonation_weak_encryption_configuration.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index eed19e1c7e..34af5dc48d 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: splunk_server - type: hostname + type: Hostname role: - victim product: diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index 17cf657ae4..adba811768 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -20,7 +20,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 75 + confidence: 70 context: - Source:Endpoint dataset: @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: host - type: hostname + type: Hostname role: - victim product: @@ -48,5 +48,5 @@ tags: - serverclass - peer - host - risk_score: 37 + risk_score: 35 security_domain: threat diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 7ccd69f476..ded2d69f49 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: splunk_server - type: hostname + type: Hostname role: - victim product: