From b7e1a5fe944926ae177017f73f2863cbb7f7b901 Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 16 Aug 2022 11:30:24 -0400 Subject: [PATCH] adding new detections --- ...ndpoint_denial_of_service_dos_zip_bomb.yml | 51 +++++++++++++++++++ ...scovery_drilldown_dashboard_disclosure.yml | 49 ++++++++++++++++++ ...nt_denial_of_service_dos_zip_bomb.test.yml | 13 +++++ 3 files changed, 113 insertions(+) create mode 100644 detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml create mode 100644 detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml create mode 100644 tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml diff --git a/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml b/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml new file mode 100644 index 0000000000..d2290ab2f8 --- /dev/null +++ b/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml @@ -0,0 +1,51 @@ +name: Splunk Endpoint Denial of Service DoS Zip Bomb +id: b237d393-2f57-4531-aad7-ad3c17c8b041 +version: 1 +date: '2022-08-02' +author: Marissa Bower, Rod Soto, Splunk +type: TTP +datamodel: [] +search: '`splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary* |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`' +description: This search allows operator to identify Splunk search app crashes resulting from specially crafted ZIP file using file monitoring that affects UF versions 8.1.11 and 8.2 versions below 8.2.7.1. It is not possible to detect Zip Bomb attack before crash. This search will provide Universal Forwarder errors from uploaded binary files (zip compression) which are used for this attack. If an analyst sees results from this search we suggest you investigate and triage what zip file was uploaded, zip compressed files may have different extensions. +how_to_implement: Need to monitor Splunkd data from Universal Forwarders. +known_false_positives: This search may reveal non malicious zip files causing errors as well. +references: +- https://en.wikipedia.org/wiki/ZIP_(file_format) +- https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-37439 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 75 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log + impact: 100 + kill_chain_phases: + - Exploitation + message: Potential exposure of environment variables from url embedded in dashboard + mitre_attack_id: + - T1499 + observable: + - name: host + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - source + - component + - event_message + - host + risk_score: 75 + security_domain: threat diff --git a/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml b/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml new file mode 100644 index 0000000000..2aa47bbf0e --- /dev/null +++ b/detections/experimental/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml @@ -0,0 +1,49 @@ +name: Splunk Account Discovery Drilldown Dashboard Disclosure +id: f844c3f6-fd99-43a2-ba24-93e35fe84be6 +version: 1 +date: '2022-08-02' +author: Marissa Bower, Rod Soto, Splunk +type: TTP +datamodel: [] +search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_drilldown_dashboard_disclosure_filter`' +description: Splunk drilldown vulnerability disclosure in Dashboard application that can potentially allow exposure of tokens from privilege users. An attacker can create dashboard and share it to privileged user (admin) and detokenize variables using external urls within dashboards drilldown function. +how_to_implement: This search uses REST function to query for dashboards with environment variables present in URL options. +known_false_positives: This search may reveal non malicious URLs with environment variables used in organizations. +references: +- https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-37438 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + impact: 50 + kill_chain_phases: + - Exploitation + message: Potential exposure of environment variables from url embedded in dashboard + mitre_attack_id: + - T1087 + observable: + - name: author + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - eai:data + - splunk_server + - author + - eai:acl.sharing + - eai:appName + risk_score: 40 + security_domain: threat diff --git a/tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml b/tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml new file mode 100644 index 0000000000..033a1c48b1 --- /dev/null +++ b/tests/application/splunk_endpoint_denial_of_service_dos_zip_bomb.test.yml @@ -0,0 +1,13 @@ +name: Splunk Endpoint Denial of Service DoS Zip Bomb Unit Test +tests: +- name: Splunk Endpoint Denial of Service DoS Zip Bomb + file: application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splunk_zip_bomb_vulnerability.log + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log + source: /opt/splunkforwarder/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal