Branch was auto-updated.

detections/application/splunk_dos_via_printf_search_function.yml

@@ -0,0 +1,50 @@
+name: Splunk DOS via printf search function
+id: 78b48d08-075c-4eac-bd07-e364c3780867
+version: 1
+date: '2023-08-30'
+author: Rod Soto, Eric McGinnis, Splunk
+status: production
+type: Hunting
+data_source: []
+description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
+search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search!="*audit_searches*" 
+  | stats count by user splunk_server host search 
+  | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
+how_to_implement: This search requires the ability to search internal indexes. 
+known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. 
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  confidence: 100
+  impact: 100
+  message: Possible denial of service attack against $host$
+  cve:
+  - CVE-2023-40594
+  mitre_attack_id:
+  - T1499.004
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 100
+  required_fields:
+  - user 
+  - splunk_server
+  - host
+  - search 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml

@@ -1,17 +1,13 @@
 name: Splunk risky Command Abuse disclosed february 2023
 id: ee69374a-d27e-4136-adac-956a96ff60fd
 version: 2
-date: '2023-02-14'
+date: '2023-08-30'
 author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
 status: production
 type: Hunting
-description: In February 2023, Splunk disclosed several vulnerabilities affecting
-  Splunk Enterprise commands deemed risky. The following hunting search includes the
-  following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10),
-  pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below
-  8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more
-  information please review Splunk Vulnerabilities Disclosure, February 2023. Link
-  can be found in reference.
+description: This search looks for a variety of high-risk commands throughout
+  a number of different Splunk Vulnerability Disclosures.  Please refer to the
+  following URL for additional information on these disclosures - https://advisory.splunk.com
 data_source: []
 search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity
   where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
@@ -35,6 +31,7 @@ tags:
   - CVE-2023-22936
   - CVE-2023-22939
   - CVE-2023-22940
+  - CVE-2023-40598
   impact: 50
   message: Use of risky splunk command $splunk_risky_command$ detected by $user$
   mitre_attack_id:
@@ -67,3 +64,9 @@ tests:
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
+- name: True Positive Test runshellscript abuse
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

lookups/splunk_risky_command.yml

@@ -1,5 +1,5 @@
 description: A list of Risky Splunk Command that are candidates for abuse
-filename: splunk_risky_command.csv
+filename: splunk_risky_command_20230830.csv
 name: splunk_risky_command
 default_match: 'false'
 match_type: WILDCARD(splunk_risky_command)

lookups/splunk_risky_command_20230830.csv

@@ -8,4 +8,5 @@
 "*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
+"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
+"*| *runshellscript* """"*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards","<8.1.14, <8.2.12, <9.0.6, <9.1.1","CVE-2023-40598",""