Merge pull request #2326 from splunk/splunk_vulz_aug_16th

adding new detections

detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml

@@ -0,0 +1,51 @@
+name: Splunk Endpoint Denial of Service DoS Zip Bomb
+id: b237d393-2f57-4531-aad7-ad3c17c8b041
+version: 1
+date: '2022-08-02'
+author: Marissa Bower, Rod Soto, Splunk
+type: TTP
+datamodel: []
+search: '`splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary* |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`'
+description: This search allows operator to identify Splunk search app crashes resulting from specially crafted ZIP file using file monitoring that affects UF versions 8.1.11 and 8.2 versions below 8.2.7.1. It is not possible to detect Zip Bomb attack before crash. This search will provide Universal Forwarder errors from uploaded binary files (zip compression) which are used for this attack. If an analyst sees results from this search we suggest you investigate and triage what zip file was uploaded, zip compressed files may have different extensions.
+how_to_implement: Need to monitor Splunkd data from Universal Forwarders.
+known_false_positives: This search may reveal non malicious zip files causing errors as well.
+references:
+- https://en.wikipedia.org/wiki/ZIP_(file_format)
+- https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+  - CVE-2022-37439
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 75
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: Potential exposure of environment variables from url embedded in dashboard
+  mitre_attack_id:
+  - T1499
+  observable:
+  - name: host
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - source
+  - component
+  - event_message
+  - host
+  risk_score: 75
+  security_domain: threat

detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml

@@ -0,0 +1,49 @@
+name: Splunk Account Discovery Drilldown Dashboard Disclosure
+id: f844c3f6-fd99-43a2-ba24-93e35fe84be6
+version: 1
+date: '2022-08-02'
+author: Marissa Bower, Rod Soto, Splunk
+type: TTP
+datamodel: []
+search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_drilldown_dashboard_disclosure_filter`'
+description: Splunk drilldown vulnerability disclosure in Dashboard application that can potentially allow exposure of tokens from privilege users. An attacker can create dashboard and share it to privileged user (admin) and detokenize variables using external urls within dashboards drilldown function.
+how_to_implement: This search uses REST function to query for dashboards with environment variables present in URL options.
+known_false_positives: This search may reveal non malicious URLs with environment variables used in organizations.
+references:
+- https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+  - CVE-2022-37438 
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Potential exposure of environment variables from url embedded in dashboard
+  mitre_attack_id:
+  - T1087
+  observable:
+  - name: author
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - eai:data
+  - splunk_server
+  - author
+  - eai:acl.sharing
+  - eai:appName
+  risk_score: 40
+  security_domain: threat

tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml

@@ -0,0 +1,13 @@
+name: Splunk Endpoint Denial of Service DoS Zip Bomb Unit Test
+tests:
+- name: Splunk Endpoint Denial of Service DoS Zip Bomb
+  file: application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: splunk_zip_bomb_vulnerability.log
+    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log
+    source: /opt/splunkforwarder/var/log/splunk/splunkd.log
+    sourcetype: splunkd
+    custom_index: _internal