mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
Vendored
+1
-1
File diff suppressed because one or more lines are too long
Vendored
+1
-1
File diff suppressed because one or more lines are too long
Vendored
+1
-1
File diff suppressed because one or more lines are too long
Vendored
+1
-1
@@ -5,7 +5,7 @@
|
||||
"id": {
|
||||
"group": null,
|
||||
"name": "DA-ESS-ContentUpdate",
|
||||
"version": "4.3.0"
|
||||
"version": "4.4.0"
|
||||
},
|
||||
"author": [
|
||||
{
|
||||
|
||||
+72
-2
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# On Date: 2023-06-01T18:34:38 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -375,6 +375,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization"], "mit
|
||||
known_false_positives = None at this time
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk DOS Via Dump SPL Command - Rule]
|
||||
type = detection
|
||||
asset_type = endpoint
|
||||
confidence = medium
|
||||
explanation = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
|
||||
how_to_implement = This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499.004"], "nist": ["DE.AE"]}
|
||||
known_false_positives = Segmentation faults may occur due to other causes, so this search may produce false positives
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk DoS via Malformed S2S Request - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -385,6 +395,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
|
||||
known_false_positives = None.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk Edit User Privilege Escalation - Rule]
|
||||
type = detection
|
||||
asset_type = endpoint
|
||||
confidence = medium
|
||||
explanation = A low-privilege user who holds a role that has the edit_user capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
|
||||
how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover abuse of edit_user privilege.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"]}
|
||||
known_false_positives = This search may produce false positives as password changing actions may be part of normal behavior. Operator will need to investigate these actions in order to discern exploitation attempts.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -395,6 +415,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
|
||||
known_false_positives = This search may reveal non malicious zip files causing errors as well.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule]
|
||||
type = detection
|
||||
asset_type = endpoint
|
||||
confidence = medium
|
||||
explanation = A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
|
||||
how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.006"], "nist": ["DE.AE"]}
|
||||
known_false_positives = This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -415,6 +445,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
|
||||
known_false_positives = It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above. If a user is not believed to be legitimate, then further investigation should take place.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule]
|
||||
type = detection
|
||||
asset_type = endpoint
|
||||
confidence = medium
|
||||
explanation = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.
|
||||
how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1212"], "nist": ["DE.AE"]}
|
||||
known_false_positives = This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule]
|
||||
type = detection
|
||||
asset_type = endpoint
|
||||
confidence = medium
|
||||
explanation = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user with access to the Splunk App for Lookup File Editing can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory, including but not limited to the password hash file for the instance.
|
||||
how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"]}
|
||||
known_false_positives = This search may find additional path traversal exploitation attempts or malformed requests.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -425,6 +475,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
|
||||
known_false_positives = This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule]
|
||||
type = detection
|
||||
asset_type = endpoint
|
||||
confidence = medium
|
||||
explanation = In Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13, a low-privileged user can bypass URL validation to perform a path traversal and access restricted and confidential information by targeting other users on the instance, including the admin user. The only affected version of bootstrap which shipped with Splunk was version 2.3.1, so the search is targeted at that version alone.
|
||||
how_to_implement = This search does not require additional data to be ingested. This search requires ability to search _internal index. This search helps discover access to vulnerable bootstrap versions.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
|
||||
known_false_positives = This search will produce numerous false positives as it shows ANY accesses to vulnerable bootstrap Javascript files. Accesses to these files occur during normal Splunk usage. To reduce or eliminate false positives, update the a version of Splunk which has addressed the vulnerability.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -465,6 +525,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization"], "mit
|
||||
known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule]
|
||||
type = detection
|
||||
asset_type = endpoint
|
||||
confidence = medium
|
||||
explanation = An unauthorized user can use the /services/indexing/preview REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.
|
||||
how_to_implement = This search does not require additional data ingestion. It requires the ability to search _internal index.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134"], "nist": ["DE.AE"]}
|
||||
known_false_positives = This is a hunting search which provides verbose results against this endpoint. Operator must consider things such as IP address, useragent and user(specially low privelege) and host to investigate possible attack.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -15096,7 +15166,7 @@ version = 1
|
||||
references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
|
||||
searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DOS Via Dump SPL Command - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Edit User Privilege Escalation - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule", "ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
|
||||
description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
|
||||
narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.
|
||||
|
||||
|
||||
Vendored
+2
-2
@@ -4,7 +4,7 @@
|
||||
is_configured = false
|
||||
state = enabled
|
||||
state_change_requires_restart = false
|
||||
build = 14375
|
||||
build = 14461
|
||||
|
||||
[triggers]
|
||||
reload.analytic_stories = simple
|
||||
@@ -20,7 +20,7 @@ reload.es_investigations = simple
|
||||
|
||||
[launcher]
|
||||
author = Splunk
|
||||
version = 4.3.0
|
||||
version = 4.4.0
|
||||
description = Explore the Analytic Stories included with ES Content Updates.
|
||||
|
||||
[ui]
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# On Date: 2023-06-01T18:34:38 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
+1
-1
@@ -1,2 +1,2 @@
|
||||
[content-version]
|
||||
version = 4.3.0
|
||||
version = 4.4.0
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# On Date: 2023-06-01T18:34:38 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
Vendored
+37
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# On Date: 2023-06-01T18:34:38 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -145,14 +145,26 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_dos_via_dump_spl_command_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_dos_via_malformed_s2s_request_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_edit_user_privilege_escalation_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_endpoint_denial_of_service_dos_zip_bomb_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_http_response_splitting_via_rest_spl_command_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_improperly_formatted_parameter_crashes_splunkd_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
@@ -161,10 +173,22 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_low_privilege_user_can_view_hashed_splunk_password_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[persistent_xss_in_rapiddiag_through_user_interface_views_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_process_injection_forwarder_bundle_downloads_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
@@ -181,6 +205,10 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
@@ -5214,6 +5242,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
|
||||
definition = index=_audit sourcetype=audittrail action=search
|
||||
description = Macro to enable easy searching of audittrail logs for searches
|
||||
|
||||
[audittrail]
|
||||
definition = index=_audit sourcetype=audittrail
|
||||
description = Macro to enable easy searching of audittrail logs
|
||||
|
||||
[aws_cloudwatchlogs_eks]
|
||||
definition = sourcetype="aws:cloudwatchlogs:eks"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
@@ -5771,6 +5803,10 @@ description = search data model's summaries only
|
||||
definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
|
||||
description = This macro is a list of AWS event names associated with security groups
|
||||
|
||||
[splunk_crash_log]
|
||||
definition = (index=_internal AND sourcetype=splunkd_crash_log)
|
||||
description = Searches through the Splunk Crash Log for low-level errors and crashes
|
||||
|
||||
[splunk_python]
|
||||
definition = index=_internal sourcetype=splunk_python
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
Vendored
+246
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# On Date: 2023-06-01T18:34:38 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -1483,6 +1483,41 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`
|
||||
|
||||
[ESCU - Splunk DOS Via Dump SPL Command - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
|
||||
action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499.004"], "nist": ["DE.AE"]}
|
||||
action.escu.data_models = []
|
||||
action.escu.eli5 = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
|
||||
action.escu.how_to_implement = This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults.
|
||||
action.escu.known_false_positives = Segmentation faults may occur due to other causes, so this search may produce false positives
|
||||
action.escu.creation_date = 2023-05-10
|
||||
action.escu.modification_date = 2023-05-10
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Splunk DOS Via Dump SPL Command - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise"]
|
||||
action.escu.providing_technologies = null
|
||||
action.escu.analytic_story = ["Splunk Vulnerabilities"]
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Splunk DOS Via Dump SPL Command - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499.004"], "nist": ["DE.AE"]}
|
||||
schedule_window = auto
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`
|
||||
|
||||
[ESCU - Splunk DoS via Malformed S2S Request - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
@@ -1529,6 +1564,41 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`
|
||||
|
||||
[ESCU - Splunk Edit User Privilege Escalation - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = A low-privilege user who holds a role that has the edit_user capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
|
||||
action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"]}
|
||||
action.escu.data_models = []
|
||||
action.escu.eli5 = A low-privilege user who holds a role that has the edit_user capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
|
||||
action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover abuse of edit_user privilege.
|
||||
action.escu.known_false_positives = This search may produce false positives as password changing actions may be part of normal behavior. Operator will need to investigate these actions in order to discern exploitation attempts.
|
||||
action.escu.creation_date = 2023-05-23
|
||||
action.escu.modification_date = 2023-05-23
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Splunk Edit User Privilege Escalation - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = null
|
||||
action.escu.analytic_story = ["Splunk Vulnerabilities"]
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Splunk Edit User Privilege Escalation - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"]}
|
||||
schedule_window = auto
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `audittrail` action IN ("change_own_password","password_change","edit_password") AND info="granted" AND NOT user IN (admin, splunk-system-user) | stats earliest(_time) as event_time values(index) as index values(sourcetype) as sourcetype values(action) as action values(info) as info by user | `splunk_edit_user_privilege_escalation_filter`
|
||||
|
||||
[ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
@@ -1575,6 +1645,41 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary* |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`
|
||||
|
||||
[ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
|
||||
action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.006"], "nist": ["DE.AE"]}
|
||||
action.escu.data_models = []
|
||||
action.escu.eli5 = A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
|
||||
action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss.
|
||||
action.escu.known_false_positives = This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators.
|
||||
action.escu.creation_date = 2023-05-23
|
||||
action.escu.modification_date = 2023-05-23
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise"]
|
||||
action.escu.providing_technologies = null
|
||||
action.escu.analytic_story = ["Splunk Vulnerabilities"]
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.006"], "nist": ["DE.AE"]}
|
||||
schedule_window = auto
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="index=_audit" | table user info has_error_msg search _time | `splunk_http_response_splitting_via_rest_spl_command_filter`
|
||||
|
||||
[ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
@@ -1656,6 +1761,76 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | rest splunk_server=local /services/authentication/users |search capabilities=admin* OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server | `splunk_list_all_nonstandard_admin_accounts_filter`
|
||||
|
||||
[ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.
|
||||
action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1212"], "nist": ["DE.AE"]}
|
||||
action.escu.data_models = []
|
||||
action.escu.eli5 = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.
|
||||
action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content.
|
||||
action.escu.known_false_positives = This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts.
|
||||
action.escu.creation_date = 2023-05-09
|
||||
action.escu.modification_date = 2023-05-09
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise"]
|
||||
action.escu.providing_technologies = null
|
||||
action.escu.analytic_story = ["Splunk Vulnerabilities"]
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1212"], "nist": ["DE.AE"]}
|
||||
schedule_window = auto
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" | stats earliest(_time) as event_time values(method) as method values(status) as status values(clientip) as clientip values(useragent) as useragent values(file) as file by user | convert ctime(*time) | `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`
|
||||
|
||||
[ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user with access to the Splunk App for Lookup File Editing can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory, including but not limited to the password hash file for the instance.
|
||||
action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"]}
|
||||
action.escu.data_models = []
|
||||
action.escu.eli5 = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user with access to the Splunk App for Lookup File Editing can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory, including but not limited to the password hash file for the instance.
|
||||
action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
|
||||
action.escu.known_false_positives = This search may find additional path traversal exploitation attempts or malformed requests.
|
||||
action.escu.creation_date = 2023-05-11
|
||||
action.escu.modification_date = 2023-05-11
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise"]
|
||||
action.escu.providing_technologies = null
|
||||
action.escu.analytic_story = ["Splunk Vulnerabilities"]
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"]}
|
||||
schedule_window = auto
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file owner namespace version | stats count by clientip namespace lookup_file uri_query | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`
|
||||
|
||||
[ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
@@ -1702,6 +1877,41 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/* action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`
|
||||
|
||||
[ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = In Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13, a low-privileged user can bypass URL validation to perform a path traversal and access restricted and confidential information by targeting other users on the instance, including the admin user. The only affected version of bootstrap which shipped with Splunk was version 2.3.1, so the search is targeted at that version alone.
|
||||
action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
|
||||
action.escu.data_models = []
|
||||
action.escu.eli5 = In Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13, a low-privileged user can bypass URL validation to perform a path traversal and access restricted and confidential information by targeting other users on the instance, including the admin user. The only affected version of bootstrap which shipped with Splunk was version 2.3.1, so the search is targeted at that version alone.
|
||||
action.escu.how_to_implement = This search does not require additional data to be ingested. This search requires ability to search _internal index. This search helps discover access to vulnerable bootstrap versions.
|
||||
action.escu.known_false_positives = This search will produce numerous false positives as it shows ANY accesses to vulnerable bootstrap Javascript files. Accesses to these files occur during normal Splunk usage. To reduce or eliminate false positives, update the a version of Splunk which has addressed the vulnerability.
|
||||
action.escu.creation_date = 2023-05-09
|
||||
action.escu.modification_date = 2023-05-09
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise"]
|
||||
action.escu.providing_technologies = null
|
||||
action.escu.analytic_story = ["Splunk Vulnerabilities"]
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 20, "cve": ["CVE-2019-8331"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
|
||||
schedule_window = auto
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunkd_web` method=GET uri_path="*bootstrap-2.3.1*" file="*.js" | table _time clientip uri_path file status | `splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter`
|
||||
|
||||
[ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
@@ -1842,6 +2052,41 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`
|
||||
|
||||
[ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = An unauthorized user can use the /services/indexing/preview REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.
|
||||
action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134"], "nist": ["DE.AE"]}
|
||||
action.escu.data_models = []
|
||||
action.escu.eli5 = An unauthorized user can use the /services/indexing/preview REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.
|
||||
action.escu.how_to_implement = This search does not require additional data ingestion. It requires the ability to search _internal index.
|
||||
action.escu.known_false_positives = This is a hunting search which provides verbose results against this endpoint. Operator must consider things such as IP address, useragent and user(specially low privelege) and host to investigate possible attack.
|
||||
action.escu.creation_date = 2023-05-10
|
||||
action.escu.modification_date = 2023-05-10
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise"]
|
||||
action.escu.providing_technologies = null
|
||||
action.escu.analytic_story = ["Splunk Vulnerabilities"]
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134"], "nist": ["DE.AE"]}
|
||||
schedule_window = auto
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `splunkda` method="POST" uri="*/services/indexing/preview*" | table host clientip status useragent user uri_path | `splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter`
|
||||
|
||||
[ESCU - Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# On Date: 2023-06-01T18:34:38 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# On Date: 2023-06-01T18:34:38 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user