admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-09-05 15:35:22 -07:00
committed by GitHub
parent 4a36292c2c b6fedaa030
commit 7b1e36f2f6
12 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/api/detections.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/api/macros.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/escu/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "4.11.0"
"version": "4.11.1"
},
"author": [
{
dist/escu/default/analyticstories.conf
Vendored
+2 -2
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-08-30T17:17:05 UTC
# On Date: 2023-09-05T22:20:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -13601,7 +13601,7 @@ Our analytic pinpoints exploitation by monitoring web requests to the "/cf_scrip
If a true positive arises, it indicates an active breach attempt, potentially causing data theft, operational disruption, or reputational damage. In essence, this analytic provides a targeted approach to identify attempts exploiting a high-risk ColdFusion vulnerability. While false positives may occur from legitimate accesses, any alerts should be treated as high-priority, warranting immediate investigation to ensure security.
how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
known_false_positives = In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query. These include-\ 1. Requests to the path "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo" \ 2. Requests to the path "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/2U9UyvvwP4PGaZpjARz5VJGfpCk.jsp" \ 3. Requests to the path "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm" \ These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.
known_false_positives = In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query. Please check this github gist for the specific URIs : https://gist.github.com/patel-bhavin/d10830f3f375a2397233f6a4fe38d5c9 . These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.
providing_technologies = null
[savedsearch://ESCU - Citrix ADC Exploitation CVE-2023-3519 - Rule]
dist/escu/default/app.conf
Vendored
+2 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 16901
build = 16958
[triggers]
reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
[launcher]
author = Splunk
version = 4.11.0
version = 4.11.1
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-08-30T17:17:05 UTC
# On Date: 2023-09-05T22:20:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 4.11.0
version = 4.11.1
dist/escu/default/es_investigations.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-08-30T17:17:05 UTC
# On Date: 2023-09-05T22:20:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-08-30T17:17:05 UTC
# On Date: 2023-09-05T22:20:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/savedsearches.conf
Vendored
+2 -2
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-08-30T17:17:05 UTC
# On Date: 2023-09-05T22:20:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -57068,7 +57068,7 @@ action.escu.eli5 = The following analytic detects potential exploitation of the
Our analytic pinpoints exploitation by monitoring web requests to the "/cf_scripts/scripts/ajax/ckeditor/*" path. This focus helps differentiate malicious activity from standard ColdFusion traffic. For SOCs, detecting such attempts is vital given the vulnerability's CVSS score of 9.8, signaling its severity. Successful exploitation can lead to unauthorized data access, further attacks, or severe operational disruptions. \
If a true positive arises, it indicates an active breach attempt, potentially causing data theft, operational disruption, or reputational damage. In essence, this analytic provides a targeted approach to identify attempts exploiting a high-risk ColdFusion vulnerability. While false positives may occur from legitimate accesses, any alerts should be treated as high-priority, warranting immediate investigation to ensure security.
action.escu.how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
action.escu.known_false_positives = In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query. These include-\ 1. Requests to the path "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo" \ 2. Requests to the path "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/2U9UyvvwP4PGaZpjARz5VJGfpCk.jsp" \ 3. Requests to the path "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm" \ These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.
action.escu.known_false_positives = In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query. Please check this github gist for the specific URIs : https://gist.github.com/patel-bhavin/d10830f3f375a2397233f6a4fe38d5c9 . These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.
action.escu.creation_date = 2023-08-23
action.escu.modification_date = 2023-08-23
action.escu.confidence = high
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-08-30T17:17:05 UTC
# On Date: 2023-09-05T22:20:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/workflow_actions.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-08-30T17:17:05 UTC
# On Date: 2023-09-05T22:20:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############