revert to 4.14.0

.gitignore

@@ -1,8 +1,16 @@
 # Ignore example files from contentctl tool
-
+apps/
+test_results/
 detections/*/.yml.example
 stories/*.yml.example
 tests/*/*.yml.example
+artifacts/
+contentctl/*
+dist/DA-ESS-ContentUpdate-*.tar.gz
+dist/DA-ESS-ContentUpdate.tar.gz
+dist/ContentPack-*.appinspect_api_results.html
+dist/ContentPack-*.appinspect_api_results.json
+
 
 # IDE
 .vscode/

.gitlab-ci.yml

@@ -1,27 +1,20 @@
-stages:
-  - publish_build_to_pre_qa
+default:
+  image: docker-hub.repo.splunkdev.net/python:3.9
 
-publish_build_to_pre_qa:
-  stage: publish_build_to_pre_qa
-  artifacts:
-    when: always
-    paths:
-      - artifacts/*
-  image: python:3.8-alpine
-  before_script:
-    - apk add --update --no-cache make curl bash git
-    - curl -L https://github.com/screwdriver-cd/gitversion/releases/download/v1.1.1/gitversion_linux_amd64 -o /usr/local/bin/gitversion && chmod +x /usr/local/bin/gitversion
-    - eval $(ssh-agent -s)
-  script:
-    - mkdir -p artifacts
-    - pip install requests
-    - VERSION=$(git tag --sort=-creatordate | head -n 1)
-    - echo "Build Version - $VERSION"
-    - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $VERSION --builds DA-ESS-ContentUpdate SSA_Content
-  after_script:
-    - cp publish_build_to_pre_qa.log artifacts/publish_build_to_pre_qa.log
+stages:
+  - validate
+  - generate
+  - app_inspect
+  - release
+
+include:
+  - local: "pipeline/.validate.yml"
+  - local: "pipeline/.generate.yml"
+  - local: "pipeline/.app_inspect.yml"
+  - local: "pipeline/.release.yml"
+
+workflow:
   rules:
-    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]$/'
-      when: always
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
-      when: always
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+    - if: $CI_COMMIT_TAG
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "contentctl"]
+	path = contentctl
+	url = https://github.com/splunk/contentctl.git
+	ignore = all

bin/contentctl_project/contentctl_core/domain/entities/detection.py

@@ -193,14 +193,3 @@ class Detection(BaseModel, SecurityContentObject):
             )
         return v
 
-    @validator("experimental", always=True)
-    def experimental_validate(cls, v, values):
-        if DetectionStatus(values["status"]) == DetectionStatus.experimental:
-            return True
-        return False
-
-    @validator("deprecated", always=True)
-    def deprecated_validate(cls, v, values):
-        if DetectionStatus(values["status"]) == DetectionStatus.deprecated:
-            return True
-        return False

bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2

@@ -5,7 +5,7 @@
 [ESCU - {{ detection.name }} - Rule]
 action.escu = 0
 action.escu.enabled = 1
-{% if detection.deprecated %}
+{% if detection.status == "deprecated" %}
 description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. {{ detection.description }} 
 {% else %}
 description = {{ detection.description }}
@@ -52,7 +52,7 @@ cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
 dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
 dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
 action.correlationsearch.enabled = 1
-{% if detection.deprecated %}
+{% if detection.status == "deprecated" %}
 action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule
 {% elif detection.type | lower == "correlation" %}
 action.correlationsearch.label = ESCU - RIR - {{ detection.name }} - Rule

contentctl.yml

@@ -0,0 +1,22 @@
+build:
+  name: DA-ESS-ContentUpdate
+  path_root: dist
+  prefix: ESCU
+  build: 004150
+  version: 4.14.1
+  label: ES Content Updates
+  author_name: Splunk Threat Research Team
+  author_email: research@splunk.com
+  author_company: Splunk
+  description: Explore the Analytic Stories included with ES Content Updates.
+  splunk_app: {}
+  json_objects: null
+  ba_objects: null
+build_ssa:
+  path_root: 'dist/ssa'
+build_api:
+  path_root: 'dist/api'
+enrichments:
+  attack_enrichment: false
+  cve_enrichment: false
+  splunk_app_enrichment: false

contentctl_test.yml

@@ -0,0 +1,70 @@
+version_control_config: null
+infrastructure_config:
+  infrastructure_type: container
+  full_image_path: registry.hub.docker.com/splunk/splunk:latest
+post_test_behavior: always_pause
+mode: all
+detections_list: null
+splunkbase_username: null
+splunkbase_password: null
+apps:
+- uid: 6176
+  appid: Splunk_TA_linux_sysmon
+  title: Add-on for Linux Sysmon
+  description: null
+  release: 1.0.4
+  local_path: null
+  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz
+  splunkbase_path: null
+  environment_path: ENVIRONMENT_PATH_NOT_SET
+  force_local: false
+- uid: 742
+  appid: Splunk_TA_windows
+  title: Splunk Add-on for Microsoft Windows
+  description: null
+  release: 8.5.0
+  local_path: null
+  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850_PATCHED.tgz
+  splunkbase_path: null
+  environment_path: ENVIRONMENT_PATH_NOT_SET
+  force_local: false
+- uid: 5709
+  appid: Splunk_TA_microsoft_sysmon
+  title: Splunk Add-on for Sysmon
+  description: null
+  release: 3.0.0
+  local_path: null
+  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz
+  splunkbase_path: null
+  environment_path: ENVIRONMENT_PATH_NOT_SET
+  force_local: false
+- uid: 833
+  appid: Splunk_TA_nix
+  title: Splunk Add-on for Unix and Linux
+  description: null
+  release: 8.7.0
+  local_path: null
+  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_860.tgz
+  splunkbase_path: null
+  environment_path: ENVIRONMENT_PATH_NOT_SET
+  force_local: false
+- uid: 2734
+  appid: utbox
+  title: URL Toolbox
+  description: null
+  release: 1.9.2
+  local_path: null
+  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz
+  splunkbase_path: null
+  environment_path: ENVIRONMENT_PATH_NOT_SET
+  force_local: false
+- uid: 1621
+  appid: Splunk_SA_CIM
+  title: Splunk Common Information Model (CIM)
+  description: null
+  release: 5.0.2
+  local_path: null
+  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz
+  splunkbase_path: null
+  environment_path: ENVIRONMENT_PATH_NOT_SET
+  force_local: false

detections/application/splunk_absolute_path_traversal_using_runshellscript.yml

@@ -7,7 +7,7 @@ status: production
 type: Hunting
 data_source: []
 description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
-search: > 
+search: >- 
   `splunk_python` *runshellscript* 
   | eval log_split=split(_raw, "runshellscript: ")
   | eval array_raw = mvindex(log_split,1)

detections/endpoint/7zip_commandline_to_smb_share_path.yml

@@ -1,5 +1,5 @@
 name: 7zip CommandLine To SMB Share Path
-id: 01d29b48-ff6f-11eb-b81e-acde48001122
+id: 01d29b48-ff6f-11eb-b81e-acde48001123
 version: 1
 date: '2021-08-17'
 author: Teoderick Contreras, Splunk

detections/endpoint/icedid_exfiltrated_archived_file_creation.yml

@@ -27,7 +27,7 @@ tags:
   asset_type: Endpoint
   confidence: 90
   impact: 80
-  message: Process $process_name$ create a file $TargetImage$ on host $dest$
+  message: Process $process_name$ create a file $TargetFilename$ on host $dest$
   mitre_attack_id:
   - T1560.001
   - T1560

detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml

@@ -17,8 +17,11 @@ description: The following analytic leverages Event 4768, A Kerberos authenticat
   ticket may be used to obtain unauthorized access to systems and other network resources.
 data_source:
 - Windows Security 4768
-search: ' `wineventlog_security` EventCode=4768 Ticket_Encryption_Type=0x17 Account_Name!=*$
-  | `kerberos_tgt_request_using_rc4_encryption_filter` '
+search: ' `wineventlog_security` EventCode=4768 Ticket_Encryption_Type=0x17 Account_Name!=*$ 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Account_Name Client_Address dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `kerberos_tgt_request_using_rc4_encryption_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.

detections/endpoint/rundll32_dnsquery.yml

@@ -29,8 +29,7 @@ tags:
   asset_type: Endpoint
   confidence: 80
   impact: 70
-  message: rundll32 process $process_name$ having a dns query to $QueryName$ in host
-    $dest$
+  message: rundll32 process $process_name$ made a DNS query for $query$ from host $dest$
   mitre_attack_id:
   - T1218
   - T1218.011

detections/endpoint/windows_admin_permission_discovery.yml

@@ -16,7 +16,7 @@ description: This analytic is developed to identify suspicious file creation in
   similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets.
 search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem 
   where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") 
-  by Filesystem.dest Filesystem.file_create_time Filesystem.process_id Filesystem.process_guiid Filesystem.file_name Filesystem.file_path Filesystem.user 
+  by Filesystem.dest Filesystem.file_create_time Filesystem.process_id Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.user 
   | `drop_dm_object_name(Filesystem)` 
   | eval dropped_file_path = split(file_path, "\\") 
   | eval dropped_file_path_split_count = mvcount(dropped_file_path) 
@@ -26,7 +26,7 @@ search: '|tstats `security_content_summariesonly` count min(_time) as firstTime
   | `windows_admin_permission_discovery_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that 
   include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: administrator is capable of dropping files in root C drive.
+known_false_positives: False positives may occur if there are legitimate accounts with the privilege to drop files in the root of the C drive. It's recommended to verify the legitimacy of such actions and the accounts involved.
 references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
 tags:
@@ -64,6 +64,9 @@ tags:
   - Filesystem.process_id
   - Filesystem.file_name
   - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.process_guid
+  - Filesystem.file_path
   security_domain: endpoint
 tests:
 - name: True Positive Test

detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml

@@ -0,0 +1,66 @@
+name: Citrix ADC and Gateway Unauthorized Data Disclosure
+id: b593cac5-dd20-4358-972a-d945fefdaf17
+version: 1
+date: '2023-10-24'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic detects attempts to exploit the Citrix Bleed vulnerability, which can lead to the leaking of session tokens. The vulnerability, identified as CVE-2023-4966, pertains to sensitive information disclosure in NetScaler ADC and NetScaler Gateway when set up as various server configurations. The analytic specifically searches for HTTP requests with a 200 status code targeting the /oauth/idp/.well-known/openid-configuration URL endpoint. By parsing web traffic and filtering based on the aforementioned criteria along with specific user agent details, HTTP method, source and destination IPs, and the sourcetype, the analytic aims to identify potentially malicious requests that fit the profile of this exploit. \
+
+  This behavior is essential for a Security Operations Center (SOC) to identify because if successfully exploited, attackers can gain unauthorized access, leading to a potential breach or further malicious activities within the organization's network. As the Citrix Bleed vulnerability can disclose session tokens, a successful exploit can allow attackers to impersonate legitimate users, bypassing authentication mechanisms and accessing sensitive data or systems. \
+
+  If a true positive is confirmed, it implies that an attacker is actively exploiting the vulnerability within the organization's environment. This could lead to severe consequences, including unauthorized data access, further propagation within the network, and potential disruptions or exfiltration of critical information. \
+
+  Upon flagging such activity, it's crucial for analysts to swiftly validate the alert, assess the nature and extent of the exposure, and implement necessary measures to mitigate the threat. Reviewing the details such as user agent, source, and destination IP can help in understanding the context and intent of the attack. While it's imperative to patch vulnerable systems to prevent this exploitation, early detection through this analytic provides a valuable layer of defense, enabling timely response to thwart potential breaches.
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/oauth/idp/.well-known/openid-configuration*")  Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `citrix_adc_and_gateway_unauthorized_data_disclosure_filter`'
+how_to_implement: This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk
+  for Palo Alto. We recommend hunting in the environment first to understand the scope of the issue and then deploying this detection to monitor for future exploitation attempts. Limit or restrict to Citrix devices only if possible.
+known_false_positives: False positives may be present based on organization use of Citrix ADC and Gateway. Filter, or restrict the analytic to Citrix devices only.
+references:
+  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
+  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
+tags:
+  analytic_story:
+  - Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966
+  asset_type: Web server
+  atomic_guid: []
+  confidence: 90
+  impact: 100
+  message: Possible exploitation of Citrix Bleed vulnerability against $dest$ fron $src$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: IP Address
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 90
+  required_fields:
+  - Web.http_user_agent
+  - Web.status
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - sourcetype
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/citrix/cve-2023-4966-citrix.log
+    source: suricata
+    sourcetype: suricata

detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml

@@ -1,18 +1,18 @@
 name: Confluence CVE-2023-22515 Trigger Vulnerability
 id: 630ea8b2-2800-4f5d-9cbc-d65c567349b0
-version: 1
-date: '2023-10-12'
+version: 2
+date: '2023-10-23'
 author: Michael Haag, Splunk
 status: production
 type: TTP
 data_source: []
 description: The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, targeting the /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false* and /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0& URLs. By analyzing web logs within the Splunk 'Web' Data Model, it filters for successful accesses (HTTP status 200) to these vulnerable endpoints. Such behavior is crucial for a SOC to monitor, as it suggests attackers might be exploiting a privilege escalation flaw in Confluence. A true positive implies a possible unauthorized access or account creation with escalated privileges. Key details captured include user-agent, HTTP methods, URL length, and source and destination IPs. These insights aid SOCs in swiftly detecting and responding to threats, ensuring vulnerabilities are mitigated before substantial compromise.
-search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false*","/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&*") Web.http_method=GET Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false*","*/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&*") Web.http_method=GET Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` | `confluence_cve_2023_22515_trigger_vulnerability_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
-  on Web traffic that include fields relavent for traffic into the `Web` datamodel.
+  on Web traffic that include fields relavent for traffic into the `Web` datamodel. Tested with Suricata and nginx:plus:kv. 
 known_false_positives: False positives may be present with legitimate applications.
   Attempt to filter by dest IP or use Asset groups to restrict to Confluence servers.
 references:

detections/web/confluence_data_center_and_server_privilege_escalation.yml

@@ -1,16 +1,14 @@
 name: Confluence Data Center and Server Privilege Escalation
 id: 115bebac-0976-4f7d-a3ec-d1fb45a39a11
-version: 1
-date: '2023-10-04'
+version: 2
+date: '2023-10-18'
 author: Michael Haag, Splunk
 status: production
 type: TTP
 data_source: []
 description: The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, targeting the /setup/*.action* URL pattern. By analyzing web logs within the Splunk 'Web' Data Model, it filters for successful accesses (HTTP status 200) to these vulnerable endpoints. Such behavior is crucial for a SOC to monitor, as it suggests attackers might be exploiting a privilege escalation flaw in Confluence. A true positive implies a possible unauthorized access or account creation with escalated privileges. Key details captured include user-agent, HTTP methods, URL length, and source and destination IPs. These insights aid SOCs in swiftly detecting and responding to threats, ensuring vulnerabilities are mitigated before substantial compromise.
-search: '| tstats count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Web where Web.url IN ("/setup/*.action*") Web.status=200 
-  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
-  | `drop_dm_object_name("Web")`
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/setup/setupadministrator.action*", "*/setup/finishsetup.action*") Web.status=200  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` | `confluence_data_center_and_server_privilege_escalation_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -55,7 +53,12 @@ tags:
   - Web.http_user_agent
   security_domain: network
 tests:
-- name: True Positive Test
+- name: Nginx Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/confluence/nginx_plus_kv_confluence.log
+    source: nginx:plus:kv
+    sourcetype: nginx:plus:kv
+- name: Suricata Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/confluence/confluence_cve-2023-22515.log
     source: suricata

detections/web/hunting_for_log4shell.yml

@@ -55,7 +55,7 @@ search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]
   "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0)  | addtotals fieldname=Score,
   jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf,
   lookups | where Score > 2 | stats values(Score) by  jndi, jndi_proto, env_var, uridetect,
-  all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`'
+  all_match, jndi_fastmatch, keywords, lookups, obf, dest, src, http_method, _raw | `hunting_for_log4shell_filter`'
 how_to_implement: Out of the box, the Web datamodel is required to be pre-filled.
   However, tested was performed against raw httpd access logs. Change the first line
   to any dataset to pass the regex's against.

dist/api/deployments.json

@@ -1 +1 @@
-{"deployments": [{"name": "ESCU Default Configuration Anomaly", "id": "a9e210c6-9f50-4f8b-b60e-71bb26e4f216", "date": "2021-12-21", "author": "Patrick Bareiss", "description": "This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.", "scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "rba": {"enabled": "true"}, "tags": {"type": "Anomaly"}}, {"name": "ESCU Default Configuration Baseline", "id": "0f7ee854-1aad-4bef-89c5-5c402b488510", "date": "2021-12-21", "author": "Patrick Bareiss", "description": "This configuration file applies to all detections of type baseline.", "scheduling": {"cron_schedule": "10 0 * * *", "earliest_time": "-1450m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "Baseline"}}, {"name": "ESCU Default Configuration Correlation", "id": "36ba498c-46e8-4b62-8bde-67e984a40fb4", "date": "2021-12-21", "author": "Patrick Bareiss", "description": "This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.", "scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "notable": {"rule_description": "%description%", "rule_title": "%name%", "nes_fields": ["user", "dest"]}, "tags": {"type": "Correlation"}}, {"name": "ESCU Default Configuration Hunting", "id": "cc5895e8-3420-4ab7-af38-cf87a28f9c3b", "date": "2021-12-21", "author": "Patrick Bareiss", "description": "This configuration file applies to all detections of type hunting.", "scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "Hunting"}}, {"name": "ESCU Default Configuration TTP", "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b", "date": "2021-12-21", "author": "Patrick Bareiss", "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.", "scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "notable": {"rule_description": "%description%", "rule_title": "%name%", "nes_fields": ["user", "dest"]}, "rba": {"enabled": "true"}, "tags": {"type": "TTP"}}]}
+{"deployments": [{"name": "ESCU Default Configuration Anomaly", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "a9e210c6-9f50-4f8b-b60e-71bb26e4f216", "description": "This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.", "scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "rba": {"enabled": "true"}, "tags": {"type": "Anomaly"}}, {"name": "ESCU Default Configuration Baseline", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "0f7ee854-1aad-4bef-89c5-5c402b488510", "description": "This configuration file applies to all detections of type baseline.", "scheduling": {"cron_schedule": "10 0 * * *", "earliest_time": "-1450m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "Baseline"}}, {"name": "ESCU Default Configuration Correlation", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "36ba498c-46e8-4b62-8bde-67e984a40fb4", "description": "This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.", "scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "notable": {"rule_description": "%description%", "rule_title": "%name%", "nes_fields": ["user", "dest"]}, "tags": {"type": "Correlation"}}, {"name": "ESCU Default Configuration Hunting", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "cc5895e8-3420-4ab7-af38-cf87a28f9c3b", "description": "This configuration file applies to all detections of type hunting.", "scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "Hunting"}}, {"name": "ESCU Default Configuration TTP", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b", "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.", "scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "notable": {"rule_description": "%description%", "rule_title": "%name%", "nes_fields": ["user", "dest"]}, "rba": {"enabled": "true"}, "tags": {"type": "TTP"}}]}

dist/escu/app.manifest

@@ -1,7 +1,13 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: research@splunk.com
+#############
 {
   "schemaVersion": "1.0.0", 
   "info": {
-    "title": "ES Content Updates", 
+    "title": "ContentPack", 
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
@@ -9,7 +15,7 @@
     }, 
     "author": [
       {
-        "name": "Splunk Security Research Team", 
+        "name": "Splunk Threat Research Team", 
         "email": "research@splunk.com", 
         "company": "Splunk"
       }

dist/escu/default/analyticstories.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-18T20:29:18 UTC
-# Author: Splunk Security Research
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 

dist/escu/default/app.conf

@@ -1,10 +1,16 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: research@splunk.com
+#############
 ## Splunk app configuration file
 
 [install]
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 17448
+build = 20231024003559
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,12 +26,15 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 4.14.0
+version = 4.14.0 
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
 is_visible = true
-label      = ES Content Updates
+label = ContentPack
 
 [package]
 id = DA-ESS-ContentUpdate
+
+
+

dist/escu/default/collections.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-18T20:29:18 UTC
-# Author: Splunk Security Research
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 

dist/escu/default/content-version.conf

@@ -1,2 +1,8 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: research@splunk.com
+#############
 [content-version]
-version = 4.14.0
+version = 4.14.0 

dist/escu/default/es_investigations.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-18T20:29:18 UTC
-# Author: Splunk Security Research
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 

dist/escu/default/macros.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-18T20:29:18 UTC
-# Author: Splunk Security Research
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 

dist/escu/default/savedsearches.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-18T20:29:18 UTC
-# Author: Splunk Security Research
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 ### ESCU DETECTIONS ###
@@ -1166,7 +1166,6 @@ realtime_schedule = 0
 is_visible = false
 search = `splunk_python` *runshellscript*  | eval log_split=split(_raw, "runshellscript: ") | eval array_raw = mvindex(log_split,1) | eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","") | eval array_indices=split(data_cleaned,",") | eval runshellscript_args_count=mvcount(array_indices) | where runshellscript_args_count = 10 | eval interpreter=mvindex(array_indices,0) | eval targetScript=mvindex(array_indices,1) | eval targetScript != "*C:*" | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter targetScript | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_absolute_path_traversal_using_runshellscript_filter`
 
-
 [ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -24851,7 +24850,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search =  `wineventlog_security` EventCode=4768 Ticket_Encryption_Type=0x17 Account_Name!=*$ | `kerberos_tgt_request_using_rc4_encryption_filter` 
+search =  `wineventlog_security` EventCode=4768 Ticket_Encryption_Type=0x17 Account_Name!=*$ | stats count min(_time) as firstTime max(_time) as lastTime by Account_Name Client_Address dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kerberos_tgt_request_using_rc4_encryption_filter`
 
 [ESCU - Kerberos User Enumeration - Rule]
 action.escu = 0
@@ -35173,7 +35172,7 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = null
 action.escu.analytic_story = ["IcedID", "Living Off The Land"]
 action.risk = 1
-action.risk.param._risk_message = rundll32 process $process_name$ having a dns query to $QueryName$ in host $dest$
+action.risk.param._risk_message = rundll32 process $process_name$ made a DNS query for $query$ from host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
@@ -58801,7 +58800,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0) | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0) | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0) | eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID") OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw, "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0) | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0) | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^ /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0)  | addtotals fieldname=Score, jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, lookups | where Score > 2 | stats values(Score) by  jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`
+search = | from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0) | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0) | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0) | eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID") OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw, "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0) | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0) | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^ /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0)  | addtotals fieldname=Score, jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, lookups | where Score > 2 | stats values(Score) by  jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, lookups, obf, dest, src, http_method, _raw | `hunting_for_log4shell_filter`
 
 [ESCU - Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 - Rule]
 action.escu = 0

dist/escu/default/transforms.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-18T20:29:18 UTC
-# Author: Splunk Security Research
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 

dist/escu/default/workflow_actions.conf

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-10-18T20:29:18 UTC
-# Author: Splunk Security Research
+# On Date: 2023-10-24T00:38:29 UTC
+# Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 

dist/escu/lookups/csc_lookup.csv

@@ -1,21 +0,0 @@
-number, name
-1, Inventory of Authorized and Unauthorized Devices
-2, Inventory of Authorized and Unauthorized Software
-3, Secure Configuration of End-User Devices
-4, Continuous Vulnerability Assessment & Remediation
-5, Controlled Use of Administrative Privileges
-6, Maintenance Monitoring and Analysis of Audit Logs
-7, Email & Web Browser Protections
-8, Malware Defense
-9, Limitation & Control of Network Ports-Protocols & Services
-10, Data Recovery Capability
-11, Secure Configuration of Network Devices
-12, Boundary Defense
-13, Data Protection
-14, Controlled Access Based on Need to Know
-15, Wireless Access Control
-16, Account Monitoring and Control
-17, Security Skills Assessment and Appropriate Training
-18, Application Software Security
-19, Incident Response and Management
-20, Penetration Tests and Red Team Exercises

dist/escu/lookups/prohibited_softwares.csv

@@ -1,20 +0,0 @@
-app,note
-remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
-pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
-pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
-nc.exe,ESCU - This process is an open source tool used for network communications.
-wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
-cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
-nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
-kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
-isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
-svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
-at.exe,ESCU - This process is used to schedule other processes to run.  schtasks.exe should be used instead as it provides more flexibility.
-getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
-ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
-netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
-WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
-OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
-mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
-NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
-selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.

dist/escu/lookups/splunk_risky_command.csv

@@ -1,11 +0,0 @@
-"splunk_risky_command","description","vulnerable_versions","CVE","other_metadata"
-"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931",""
-"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934",""
-"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936",""
-"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939",""
-"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""

dist/escu/lookups/splunk_risky_command_20230830.csv

@@ -1,12 +0,0 @@
-"splunk_risky_command","description","vulnerable_versions","CVE","other_metadata"
-"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931",""
-"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934",""
-"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936",""
-"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939",""
-"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
-"*| *runshellscript* """"*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards","<8.1.14, <8.2.12, <9.0.6, <9.1.1","CVE-2023-40598",""

playbooks/risk_notable_preprocess.yml

@@ -4,7 +4,7 @@ version: 1
 date: "2021-10-22"
 author: Kelby Shelton, Splunk
 type: Investigation
-description: >
+description: >-
   "This playbook prepares a risk notable for investigation by performing the following tasks:
   1. Ensures that a risk notable links back to the original notable event with a card pinned to the HUD.
   2. Posts a link to this container in the comment field of Splunk ES.

reporting/detection_count.svg

@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="105" height="20">
+<linearGradient id="a" x2="0" y2="100%">
+  <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+  <stop offset="2" stop-opacity=".1"/>
+</linearGradient>
+
+<rect rx="3" width="65" height="20" fill="#555"/> <!-- Comment -->
+<rect rx="3" x="65" width="40" height="20" fill="#4c1"/>
+
+<path fill="#4c1" d="M63 0h4v20h-4z"/>
+
+<rect rx="3" width="105" height="20" fill="url(#a)"/>
+<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
+    <text x="30" y="14">detections</text>
+    <text x="83" y="14">1273</text>
+</g>
+</svg>

reporting/detection_coverage.svg

@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="20">
+<linearGradient id="a" x2="0" y2="100%">
+  <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+  <stop offset="2" stop-opacity=".1"/>
+</linearGradient>
+
+<rect rx="3" width="60" height="20" fill="#555"/> <!-- Comment -->
+<rect rx="3" x="60" width="40" height="20" fill="#4c1"/>
+
+<path fill="#4c1" d="M58 0h4v20h-4z"/>
+
+<rect rx="3" width="100" height="20" fill="url(#a)"/>
+<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
+    <text x="30" y="14">coverage</text>
+    <text x="80" y="14">100%</text>
+</g>
+</svg>

stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml

@@ -0,0 +1,22 @@
+name: Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966
+id: b194d644-4095-431a-bee0-a8e6ec067414
+version: 1
+date: '2023-10-24'
+author: Michael Haag, Splunk
+description: A critical security update, CVE-2023-4966, has been released for NetScaler ADC and NetScaler Gateway. This vulnerability, discovered by our internal team, can result in unauthorized data disclosure if exploited. Reports of incidents consistent with session hijacking have been received. The Cybersecurity and Infrastructure Security Agency (CISA) has added an entry for CVE-2023-4966 to its Known Exploited and Vulnerabilities Catalog. No workarounds are available for this vulnerability, and immediate installation of the recommended builds is strongly advised.
+narrative: On October 10, 2023, Cloud Software Group released builds to fix CVE-2023-4966, a vulnerability affecting NetScaler ADC and NetScaler Gateway. This vulnerability, if exploited, can lead to unauthorized data disclosure and possibly session hijacking. Although there were no known exploits at the time of disclosure, we have since received credible reports of targeted attacks exploiting this vulnerability. The Cybersecurity and Infrastructure Security Agency (CISA) has added an entry for CVE-2023-4966 to its Known Exploited and Vulnerabilities Catalog, which contains detection and mitigation guidance for observed exploitations of CVE-2023-4966 by threat actors against NetScaler ADC and NetScaler Gateway. We strongly recommend that users of affected builds immediately install the recommended builds, as this vulnerability has been identified as critical. No workarounds are available for this vulnerability.
+references:
+  - https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/
+  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
+  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
+  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
+  - https://github.com/projectdiscovery/nuclei-templates/blob/b815d23b908de52996060163091395d1c89fbeea/http/cves/2023/CVE-2023-4966.yaml
+tags:
+  analytic_story: Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection