splkselfsigneddetection

detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml

@@ -0,0 +1,41 @@
+name: Splunk protocol impersonation weak encryption selfsigned
+id: c76c7a2e-df49-414a-bb36-dce2683770de
+version: 1
+date: '2022-05-26'
+author: Rod Soto, Splunk
+type: Hunting
+datamodel: []
+search: '|index=_internal sourcetype="splunkd" certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter'
+description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates.
+how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search.
+known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward.
+references:
+- https://www.splunk.com/en_us/product-security
+- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt
+  message: Splunk default issued certificate at host$
+  mitre_attack_id:
+  -  T1588.004
+  observable:
+  - name: Hostname
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - host
+  - CN
+  - event_message
+  risk_score: 40
+  security_domain: threat

macros/splk_cert_validation_tls_selfsigned.yml

@@ -0,0 +1,4 @@
+definition: index=_internal sourcetype=splunkd
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: splunk_protocol_impersonation_weak_encryption_selfsigned

tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml

@@ -0,0 +1,12 @@
+name: Splunk protocol impersonation weak encryption simplerequest Unit Test
+tests:
+- name: Splunk protocol impersonation weak encryption simplerequest
+  file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt
+    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt
+    source: "/opt/splunk/var/log/splunk/splunkd.log"
+    sourcetype: splunkd