Initial commit of draft searches

before adding datasets

detections/application/splunk_absolute_path_traversal_using_runshellscript.yml

@@ -0,0 +1,46 @@
+name: Splunk Absolute Path Traversal Using runshellscript
+id: 356bd3fe-f59b-4f64-baa1-51495411b7ad
+version: 1
+date: '2023-09-05'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- python.log
+description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
+search: '|`splunk_python` *runshellscript* | `splunk_absolute_path_traversal_using_runshellscript_filter`'
+how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. 
+known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script.
+references:
+- https://advisory.splunk.com/advisories/SVD-2023-0806
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: endpoint
+  confidence: 70
+  impact: 50
+  message: Possible attack abusing runshellscript
+  mitre_attack_id:
+  - T1083
+  cve:
+  - CVE-2023-40597
+  observable:
+  - name: other
+    type: Unknown
+    role:
+    - Unknown
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 35
+  required_fields:
+  - search
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: UPDATE url to dataset
+    source: python.log 
+    sourcetype: splunk_python
+    custom_index: _internal 

detections/application/splunk_cmd_injection_using_external_lookups.yml

@@ -0,0 +1,48 @@
+name: Splunk cmd injection using external lookups
+id: 901ae2e2-b47b-4adc-b296-a151a8fccdca
+version: 1
+date: '2023-09-05'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- audittrial
+description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
+search: '|`audit_searches` search = \"| *runshellscript*\  \ \\\"\\\"\"    \n| stats earliest(_time) as event_time count by search user splunk_server\n\ | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups`'
+how_to_implement: Must have access to internal audit index. 
+known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. 
+references:
+- https://advisory.splunk.com/advisories 
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: endpoint
+  confidence: 50
+  impact: 30
+  message: Possible exploitation attempt against $host$
+  mitre_attack_id:
+  - T1202
+  cve:
+  - CVE-2023-40598
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 15
+  required_fields:
+  - search
+  - user 
+  - splunk_server
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: UPDATE url to dataset
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

detections/application/splunk_dos_using_malformed_saml_request.yml

@@ -0,0 +1,47 @@
+name: Splunk DoS Using Malformed SAML Request
+id: 8e8a86d5-f323-4567-95be-8e817e2baee6
+version: 1
+date: '2023-09-05'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- splunkd.log 
+description: In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang.
+search: '`splunkd` message=*error* expr=*xpointer* | stats count by component expr host event_message | `splunk_dos_using_malformed_saml_request_filter`'
+how_to_implement: Must have access to internal indexes. 
+known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file. 
+references:
+- https://advisory.splunk.com/advisories/SVD-2023-0802
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: endpoint
+  confidence: 30
+  impact: 50
+  message: Possible DoS attack against $host$
+  mitre_attack_id:
+  - T1498
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 15
+  required_fields:
+  - component
+  - expr 
+  - host 
+  - event_message 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: UPDATE url to dataset
+    source: splunkd.log
+    sourcetype: splunkd
+    custom_index: _internal

detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml

@@ -0,0 +1,50 @@
+name: Splunk Reflected XSS on app search table endpoint
+id: 182f9080-4137-4629-94ac-cb1083ac981a
+version: 1
+date: '2023-09-05'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- web_access.log 
+description: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the app search table web endpoint, which presents as the Create Table View page in Splunk Web. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. A JavaScript file within this web endpoint does not properly validate input which lets an attacker insert a payload into a function.
+search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats earliest(_time) as event_time count by clientip status user view root uri_path | convert ctime(*time) | `splunk_reflected_xss_on_app_search_table_endpoint_filter`'
+how_to_implement: Need access to the internal indexes. 
+known_false_positives: This search will produce false positives. It is necessary to also look at uri_query parameter to determine the possible malicious intention of inserting makeresults within the uri string. 
+references:
+- https://advisory.splunk.com/advisories/SVD-2023-0801
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  confidence: 40
+  impact: 30
+  message: Possible XSS attack against from $user$
+  mitre_attack_id:
+  - T1189
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 12
+  required_fields:
+  - dataset_commands
+  - clientip 
+  - status 
+  - user 
+  - view 
+  - root 
+  - uri_path 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: UPDATE url to dataset
+    source: web_access.log 
+    sourcetype: splunk_web_access
+    custom_index: _internal