From b86e956e900ad6547d0d5d745f2323d99c7a9a36 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 21 Aug 2023 11:29:21 -0700
Subject: [PATCH 01/11] Added two

---
 ...command_injection_via_external_lookups.yml | 46 ++++++++++++++++++
 .../splunk_dos_via_printf_search_function.yml | 47 +++++++++++++++++++
 2 files changed, 93 insertions(+)
 create mode 100644 detections/application/splunk_command_injection_via_external_lookups.yml
 create mode 100644 detections/application/splunk_dos_via_printf_search_function.yml

diff --git a/detections/application/splunk_command_injection_via_external_lookups.yml b/detections/application/splunk_command_injection_via_external_lookups.yml
new file mode 100644
index 0000000000..36cea32e51
--- /dev/null
+++ b/detections/application/splunk_command_injection_via_external_lookups.yml
@@ -0,0 +1,46 @@
+name: Splunk Command Injection via external lookups
+id: 854e39a9-1c7d-4129-b189-ff6335d80c3c
+version: 1
+date: '2023-08-21'
+author: Rod Soto
+status: production
+type: Hunting
+data_source: []
+description: This hunting search provides data on finding exploit attempts in Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
+search: '| `splunkd_ui` method=POST uri_path="/en-US/splunkd/__raw/servicesNS/*/search/configs*" | stats count by host method uri_path clientip | `splunk_command_injection_via_external_lookups_filter`'
+how_to_implement: This search requires web enabled interface and ability to search internal indexes. 
+known_false_positives: ???
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  confidence: 50
+  impact: 50
+  message: Possible command injection attack against $host$
+  mitre_attack_id:
+  - T1202
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 25
+  required_fields:
+  - method 
+  - host
+  - uri_path 
+  - clientip 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: data/SPL-230071.txt
+    source: splunkd_ui_access.log
+    sourcetype: splunkd_ui_access
+    custom_index: _internal
\ No newline at end of file
diff --git a/detections/application/splunk_dos_via_printf_search_function.yml b/detections/application/splunk_dos_via_printf_search_function.yml
new file mode 100644
index 0000000000..f134462f1a
--- /dev/null
+++ b/detections/application/splunk_dos_via_printf_search_function.yml
@@ -0,0 +1,47 @@
+name: Splunk DOS via printf search function
+id: 78b48d08-075c-4eac-bd07-e364c3780867
+version: 1
+date: '2023-08-21'
+author: Rod Soto
+status: production
+type: Hunting
+data_source: []
+description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
+search: '| `audit_searches` sourcetype=audittrail search=*printf* search="| makeresults
+  count=* | eval x=\"q\" | fieldformat x=printf(\"x %.1000000000000A\",1)" | stats count by user splunk_server host search | `splunk_dos_via_printf_search_function_filter`'
+how_to_implement: This search requires the ability to search internal indexes. 
+known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. 
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  confidence: 100
+  impact: 100
+  message: Possible denial of service attack against $host$
+  mitre_attack_id:
+  - T0814
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 100
+  required_fields:
+  - user 
+  - splunk_server
+  - host
+  - search 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: data/SPL-235294.txt
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

From 0112c918e9c9d6388b246a979a30512f7fd73a2a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 21 Aug 2023 15:38:03 -0700
Subject: [PATCH 02/11] updates to search

---
 ...splunk_command_injection_via_external_lookups.yml | 12 ++++++------
 .../splunk_dos_via_printf_search_function.yml        |  2 +-
 ...k_risky_command_abuse_disclosed_february_2023.yml |  6 ++++++
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/detections/application/splunk_command_injection_via_external_lookups.yml b/detections/application/splunk_command_injection_via_external_lookups.yml
index 36cea32e51..4591667ca0 100644
--- a/detections/application/splunk_command_injection_via_external_lookups.yml
+++ b/detections/application/splunk_command_injection_via_external_lookups.yml
@@ -1,4 +1,4 @@
-name: Splunk Command Injection via external lookups
+name: Splunk Interactive Use of runshellscript Command
 id: 854e39a9-1c7d-4129-b189-ff6335d80c3c
 version: 1
 date: '2023-08-21'
@@ -7,7 +7,7 @@ status: production
 type: Hunting
 data_source: []
 description: This hunting search provides data on finding exploit attempts in Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
-search: '| `splunkd_ui` method=POST uri_path="/en-US/splunkd/__raw/servicesNS/*/search/configs*" | stats count by host method uri_path clientip | `splunk_command_injection_via_external_lookups_filter`'
+search: '`audit_searches` search = "| *runshellscript* \"\""    | stats count by search user splunk_server | `splunk_interactive_use_of_runshellscript_command`'
 how_to_implement: This search requires web enabled interface and ability to search internal indexes. 
 known_false_positives: ???
 references:
@@ -40,7 +40,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: data/SPL-230071.txt
-    source: splunkd_ui_access.log
-    sourcetype: splunkd_ui_access
-    custom_index: _internal
\ No newline at end of file
+  - data: data/runshellscript.txt
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit
\ No newline at end of file
diff --git a/detections/application/splunk_dos_via_printf_search_function.yml b/detections/application/splunk_dos_via_printf_search_function.yml
index f134462f1a..43ca52d5c8 100644
--- a/detections/application/splunk_dos_via_printf_search_function.yml
+++ b/detections/application/splunk_dos_via_printf_search_function.yml
@@ -7,7 +7,7 @@ status: production
 type: Hunting
 data_source: []
 description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
-search: '| `audit_searches` sourcetype=audittrail search=*printf* search="| makeresults
+search: '`audit_searches` sourcetype=audittrail search=*printf* search="| makeresults
   count=* | eval x=\"q\" | fieldformat x=printf(\"x %.1000000000000A\",1)" | stats count by user splunk_server host search | `splunk_dos_via_printf_search_function_filter`'
 how_to_implement: This search requires the ability to search internal indexes. 
 known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. 
diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
index 88952aa032..4ccab043c1 100644
--- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
@@ -67,3 +67,9 @@ tests:
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
+- name: True Positive Test 2
+  attack_data:
+  - data: data/runshellscript.txt
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

From 63f8b8633b6845b374d0022c9c35fd8b74c73840 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 21 Aug 2023 15:46:36 -0700
Subject: [PATCH 03/11] more risky stuff

---
 .../splunk_command_injection_via_external_lookups.yml     | 8 ++++++--
 ...splunk_risky_command_abuse_disclosed_february_2023.yml | 8 +++++++-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/detections/application/splunk_command_injection_via_external_lookups.yml b/detections/application/splunk_command_injection_via_external_lookups.yml
index 4591667ca0..84b4b49360 100644
--- a/detections/application/splunk_command_injection_via_external_lookups.yml
+++ b/detections/application/splunk_command_injection_via_external_lookups.yml
@@ -7,7 +7,7 @@ status: production
 type: Hunting
 data_source: []
 description: This hunting search provides data on finding exploit attempts in Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
-search: '`audit_searches` search = "| *runshellscript* \"\""    | stats count by search user splunk_server | `splunk_interactive_use_of_runshellscript_command`'
+search: '`audit_searches` search = "| *runshellscript* \"\""    | stats count by search user splunk_server | `splunk_interactive_use_of_runshellscript_command_filter`'
 how_to_implement: This search requires web enabled interface and ability to search internal indexes. 
 known_false_positives: ???
 references:
@@ -18,7 +18,7 @@ tags:
   asset_type: endpoint
   confidence: 50
   impact: 50
-  message: Possible command injection attack against $host$
+  message: Possible command injection attack by $user$ against $splunk_server$
   mitre_attack_id:
   - T1202
   observable:
@@ -26,6 +26,10 @@ tags:
     type: Hostname
     role:
     - Victim
+  - name: user
+    type: User Name
+    role:
+      - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
index 4ccab043c1..c529045e71 100644
--- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
@@ -67,9 +67,15 @@ tests:
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
-- name: True Positive Test 2
+- name: True Positive Test RUNSHELLSCRIPT
   attack_data:
   - data: data/runshellscript.txt
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
+- name: True Positive Test printfabuse
+  attack_data:
+  - data: data/SPL-235294.txt
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit
\ No newline at end of file

From 977da1ab873df116b2e713e63102d6779100f5dd Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 21 Aug 2023 16:11:10 -0700
Subject: [PATCH 04/11] minor detection updates

---
 .../splunk_command_injection_via_external_lookups.yml           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/splunk_command_injection_via_external_lookups.yml b/detections/application/splunk_command_injection_via_external_lookups.yml
index 84b4b49360..4cf99a8610 100644
--- a/detections/application/splunk_command_injection_via_external_lookups.yml
+++ b/detections/application/splunk_command_injection_via_external_lookups.yml
@@ -22,7 +22,7 @@ tags:
   mitre_attack_id:
   - T1202
   observable:
-  - name: host
+  - name: splunk_server
     type: Hostname
     role:
     - Victim

From acc83e574d2f3638556eab850d1ae2f704df4cb2 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 22 Aug 2023 16:07:12 -0700
Subject: [PATCH 05/11] more detection and documentation updates

---
 ...command_injection_via_external_lookups.yml | 50 -------------------
 .../splunk_dos_via_printf_search_function.yml |  9 ++--
 lookups/splunk_risky_command.csv              |  3 +-
 3 files changed, 8 insertions(+), 54 deletions(-)
 delete mode 100644 detections/application/splunk_command_injection_via_external_lookups.yml

diff --git a/detections/application/splunk_command_injection_via_external_lookups.yml b/detections/application/splunk_command_injection_via_external_lookups.yml
deleted file mode 100644
index 4cf99a8610..0000000000
--- a/detections/application/splunk_command_injection_via_external_lookups.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-name: Splunk Interactive Use of runshellscript Command
-id: 854e39a9-1c7d-4129-b189-ff6335d80c3c
-version: 1
-date: '2023-08-21'
-author: Rod Soto
-status: production
-type: Hunting
-data_source: []
-description: This hunting search provides data on finding exploit attempts in Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
-search: '`audit_searches` search = "| *runshellscript* \"\""    | stats count by search user splunk_server | `splunk_interactive_use_of_runshellscript_command_filter`'
-how_to_implement: This search requires web enabled interface and ability to search internal indexes. 
-known_false_positives: ???
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: endpoint
-  confidence: 50
-  impact: 50
-  message: Possible command injection attack by $user$ against $splunk_server$
-  mitre_attack_id:
-  - T1202
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User Name
-    role:
-      - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  required_fields:
-  - method 
-  - host
-  - uri_path 
-  - clientip 
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: data/runshellscript.txt
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit
\ No newline at end of file
diff --git a/detections/application/splunk_dos_via_printf_search_function.yml b/detections/application/splunk_dos_via_printf_search_function.yml
index 43ca52d5c8..fbe968fa26 100644
--- a/detections/application/splunk_dos_via_printf_search_function.yml
+++ b/detections/application/splunk_dos_via_printf_search_function.yml
@@ -6,9 +6,10 @@ author: Rod Soto
 status: production
 type: Hunting
 data_source: []
-description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
-search: '`audit_searches` sourcetype=audittrail search=*printf* search="| makeresults
-  count=* | eval x=\"q\" | fieldformat x=printf(\"x %.1000000000000A\",1)" | stats count by user splunk_server host search | `splunk_dos_via_printf_search_function_filter`'
+description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
+search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search_type="adhoc" search!="*audit_searches" 
+  | stats count by user splunk_server host search 
+  | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
 how_to_implement: This search requires the ability to search internal indexes. 
 known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. 
 references:
@@ -20,6 +21,8 @@ tags:
   confidence: 100
   impact: 100
   message: Possible denial of service attack against $host$
+  cve:
+  - CVE-2023-40594
   mitre_attack_id:
   - T0814
   observable:
diff --git a/lookups/splunk_risky_command.csv b/lookups/splunk_risky_command.csv
index 9f6e6665b0..bbbe99a30a 100644
--- a/lookups/splunk_risky_command.csv
+++ b/lookups/splunk_risky_command.csv
@@ -8,4 +8,5 @@
 "*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
\ No newline at end of file
+"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
+"*| *runshellscript* """"*", "runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards", "<8.1.14, <8.2.12, <9.0.6, <9.1.1", "CVE-2023-40598", "
\ No newline at end of file

From 484ebd722cd51ce17fb26060737563112ebbfb42 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 22 Aug 2023 16:09:59 -0700
Subject: [PATCH 06/11] removed one test

---
 .../splunk_risky_command_abuse_disclosed_february_2023.yml | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
index c529045e71..05c6ad8404 100644
--- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
@@ -35,6 +35,7 @@ tags:
   - CVE-2023-22936
   - CVE-2023-22939
   - CVE-2023-22940
+  - CVE-2023-40598
   impact: 50
   message: Use of risky splunk command $splunk_risky_command$ detected by $user$
   mitre_attack_id:
@@ -70,12 +71,6 @@ tests:
 - name: True Positive Test RUNSHELLSCRIPT
   attack_data:
   - data: data/runshellscript.txt
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit
-- name: True Positive Test printfabuse
-  attack_data:
-  - data: data/SPL-235294.txt
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
\ No newline at end of file

From d838ab5435a3d590d988b0a0c8d14a7980c807d5 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Wed, 23 Aug 2023 14:49:33 -0700
Subject: [PATCH 07/11] updates to lookups, created new lookup, refined
 detection

---
 ...k_risky_command_abuse_disclosed_february_2023.yml | 10 +++-------
 lookups/splunk_risky_command.csv                     |  2 +-
 lookups/splunk_risky_command.yml                     |  2 +-
 lookups/splunk_risky_command_20230824.csv            | 12 ++++++++++++
 4 files changed, 17 insertions(+), 9 deletions(-)
 create mode 100644 lookups/splunk_risky_command_20230824.csv

diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
index 05c6ad8404..1e908fe6ed 100644
--- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
@@ -5,13 +5,9 @@ date: '2023-02-14'
 author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
 status: production
 type: Hunting
-description: In February 2023, Splunk disclosed several vulnerabilities affecting
-  Splunk Enterprise commands deemed risky. The following hunting search includes the
-  following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10),
-  pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below
-  8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more
-  information please review Splunk Vulnerabilities Disclosure, February 2023. Link
-  can be found in reference.
+description: This search looks for a variety of high-risk commands throughout
+  a number of different Splunk Vulnerability Disclosures.  Please refer to the
+  following URL for additional information on these disclosures - https://advisory.splunk.com
 data_source: []
 search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity
   where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
diff --git a/lookups/splunk_risky_command.csv b/lookups/splunk_risky_command.csv
index bbbe99a30a..5c5889fc99 100644
--- a/lookups/splunk_risky_command.csv
+++ b/lookups/splunk_risky_command.csv
@@ -9,4 +9,4 @@
 "*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
-"*| *runshellscript* """"*", "runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards", "<8.1.14, <8.2.12, <9.0.6, <9.1.1", "CVE-2023-40598", "
\ No newline at end of file
+"*| *runshellscript* """"*", "runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards", "<8.1.14, <8.2.12, <9.0.6, <9.1.1", "CVE-2023-40598", ""
\ No newline at end of file
diff --git a/lookups/splunk_risky_command.yml b/lookups/splunk_risky_command.yml
index 35411eeef0..1aa4ebb3c2 100644
--- a/lookups/splunk_risky_command.yml
+++ b/lookups/splunk_risky_command.yml
@@ -1,5 +1,5 @@
 description: A list of Risky Splunk Command that are candidates for abuse
-filename: splunk_risky_command.csv
+filename: splunk_risky_command_20230824.csv
 name: splunk_risky_command
 default_match: 'false'
 match_type: WILDCARD(splunk_risky_command)
diff --git a/lookups/splunk_risky_command_20230824.csv b/lookups/splunk_risky_command_20230824.csv
new file mode 100644
index 0000000000..5c5889fc99
--- /dev/null
+++ b/lookups/splunk_risky_command_20230824.csv
@@ -0,0 +1,12 @@
+"splunk_risky_command","description","vulnerable_versions","CVE","other_metadata"
+"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931",""
+"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934",""
+"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936",""
+"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939",""
+"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
+"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
+"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
+"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
+"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
+"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
+"*| *runshellscript* """"*", "runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards", "<8.1.14, <8.2.12, <9.0.6, <9.1.1", "CVE-2023-40598", ""
\ No newline at end of file

From 9677f38895f9f68b01bf923f89aab2705ffae9c8 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Wed, 23 Aug 2023 15:11:45 -0700
Subject: [PATCH 08/11] Update to fix dos search

---
 .../application/splunk_dos_via_printf_search_function.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/splunk_dos_via_printf_search_function.yml b/detections/application/splunk_dos_via_printf_search_function.yml
index fbe968fa26..a926b10227 100644
--- a/detections/application/splunk_dos_via_printf_search_function.yml
+++ b/detections/application/splunk_dos_via_printf_search_function.yml
@@ -7,7 +7,7 @@ status: production
 type: Hunting
 data_source: []
 description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
-search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search_type="adhoc" search!="*audit_searches" 
+search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search!="*audit_searches*" 
   | stats count by user splunk_server host search 
   | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
 how_to_implement: This search requires the ability to search internal indexes. 

From 9a2229329dbb21bc1f52f5b404c1460c915d7991 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 29 Aug 2023 16:44:36 -0700
Subject: [PATCH 09/11] Another detections update.  Matching release dates in
 files with real release date.

---
 .../splunk_dos_via_printf_search_function.yml        |  6 +++---
 ...k_risky_command_abuse_disclosed_february_2023.yml |  6 +++---
 lookups/splunk_risky_command.yml                     |  2 +-
 lookups/splunk_risky_command_20230824.csv            | 12 ------------
 ...command.csv => splunk_risky_command_20230830.csv} |  0
 5 files changed, 7 insertions(+), 19 deletions(-)
 delete mode 100644 lookups/splunk_risky_command_20230824.csv
 rename lookups/{splunk_risky_command.csv => splunk_risky_command_20230830.csv} (100%)

diff --git a/detections/application/splunk_dos_via_printf_search_function.yml b/detections/application/splunk_dos_via_printf_search_function.yml
index a926b10227..3c99abedf5 100644
--- a/detections/application/splunk_dos_via_printf_search_function.yml
+++ b/detections/application/splunk_dos_via_printf_search_function.yml
@@ -1,8 +1,8 @@
 name: Splunk DOS via printf search function
 id: 78b48d08-075c-4eac-bd07-e364c3780867
 version: 1
-date: '2023-08-21'
-author: Rod Soto
+date: '2023-08-30'
+author: Rod Soto, Eric McGinnis, Splunk
 status: production
 type: Hunting
 data_source: []
@@ -44,7 +44,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: data/SPL-235294.txt
+  - data: data/splunk_printf_abuse.log
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
index 1e908fe6ed..e6a2dd5c30 100644
--- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
@@ -1,7 +1,7 @@
 name: Splunk risky Command Abuse disclosed february 2023
 id: ee69374a-d27e-4136-adac-956a96ff60fd
 version: 2
-date: '2023-02-14'
+date: '2023-08-30'
 author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
 status: production
 type: Hunting
@@ -64,9 +64,9 @@ tests:
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
-- name: True Positive Test RUNSHELLSCRIPT
+- name: True Positive Test runshellscript abuse
   attack_data:
-  - data: data/runshellscript.txt
+  - data: data/splunk_runshellscript_abuse.log
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
\ No newline at end of file
diff --git a/lookups/splunk_risky_command.yml b/lookups/splunk_risky_command.yml
index 1aa4ebb3c2..f02dcdc19a 100644
--- a/lookups/splunk_risky_command.yml
+++ b/lookups/splunk_risky_command.yml
@@ -1,5 +1,5 @@
 description: A list of Risky Splunk Command that are candidates for abuse
-filename: splunk_risky_command_20230824.csv
+filename: splunk_risky_command_20230830.csv
 name: splunk_risky_command
 default_match: 'false'
 match_type: WILDCARD(splunk_risky_command)
diff --git a/lookups/splunk_risky_command_20230824.csv b/lookups/splunk_risky_command_20230824.csv
deleted file mode 100644
index 5c5889fc99..0000000000
--- a/lookups/splunk_risky_command_20230824.csv
+++ /dev/null
@@ -1,12 +0,0 @@
-"splunk_risky_command","description","vulnerable_versions","CVE","other_metadata"
-"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931",""
-"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934",""
-"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936",""
-"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939",""
-"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
-"*| *runshellscript* """"*", "runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards", "<8.1.14, <8.2.12, <9.0.6, <9.1.1", "CVE-2023-40598", ""
\ No newline at end of file
diff --git a/lookups/splunk_risky_command.csv b/lookups/splunk_risky_command_20230830.csv
similarity index 100%
rename from lookups/splunk_risky_command.csv
rename to lookups/splunk_risky_command_20230830.csv

From 70d84aa98228b887ee7fc2c46b60037597e1266b Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Wed, 30 Aug 2023 07:58:07 -0700
Subject: [PATCH 10/11] Fix format of lookup file - remove spaces that caused
 parsing issues.

---
 lookups/splunk_risky_command_20230830.csv | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lookups/splunk_risky_command_20230830.csv b/lookups/splunk_risky_command_20230830.csv
index 5c5889fc99..b0acb94c8e 100644
--- a/lookups/splunk_risky_command_20230830.csv
+++ b/lookups/splunk_risky_command_20230830.csv
@@ -9,4 +9,4 @@
 "*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
-"*| *runshellscript* """"*", "runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards", "<8.1.14, <8.2.12, <9.0.6, <9.1.1", "CVE-2023-40598", ""
\ No newline at end of file
+"*| *runshellscript* """"*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards","<8.1.14, <8.2.12, <9.0.6, <9.1.1","CVE-2023-40598",""

From 4d8b5b5eb434506088e0b05bfa3508e94e54d9df Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Wed, 30 Aug 2023 08:09:15 -0700
Subject: [PATCH 11/11] Final changes in prep for release. Datasets uploaded to
 attack range

---
 .../application/splunk_dos_via_printf_search_function.yml     | 4 ++--
 .../splunk_risky_command_abuse_disclosed_february_2023.yml    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/application/splunk_dos_via_printf_search_function.yml b/detections/application/splunk_dos_via_printf_search_function.yml
index 3c99abedf5..f0ef35cef4 100644
--- a/detections/application/splunk_dos_via_printf_search_function.yml
+++ b/detections/application/splunk_dos_via_printf_search_function.yml
@@ -24,7 +24,7 @@ tags:
   cve:
   - CVE-2023-40594
   mitre_attack_id:
-  - T0814
+  - T1499.004
   observable:
   - name: host
     type: Hostname
@@ -44,7 +44,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: data/splunk_printf_abuse.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
index e6a2dd5c30..f706a7c9eb 100644
--- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
@@ -66,7 +66,7 @@ tests:
     custom_index: _audit
 - name: True Positive Test runshellscript abuse
   attack_data:
-  - data: data/splunk_runshellscript_abuse.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
\ No newline at end of file