initialsearchskeleton

detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml

@@ -5,12 +5,12 @@ date: '2022-05-24'
 author: Rod Soto, Splunk
 type: Hunting
 datamodel: []
-search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host'
+search: '|splk_cert_validation_tls event_message="*SSL*" AND event_message="*ERROR*" component=HttpListener | stats count by host component event_message |dedup host | splunk_protocol_impersonation_weak_encryption_configuration_filter'
 description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.
 how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search.
 known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
 references:
-- https://www.splunk.com/en_us/product-security.
+- https://www.splunk.com/en_us/product-security
 - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
 tags:
   analytic_story:
@@ -22,13 +22,13 @@ tags:
   context:
   - Source:Endpoint
   dataset:
-  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt
   impact: 50
   kill_chain_phases:
   - Exploitation
   message: Failed to validate certificate on host$
   mitre_attack_id:
-  -  T1588.004 
+  -  T1588.004
   observable:
   - name: host
     type: host

macros/splk_cert_validation_tls.yml

@@ -0,0 +1,4 @@
+definition: index=_internal sourcetype=splunkd
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: splunkd

tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml

@@ -0,0 +1,12 @@
+name: Splunk protocol impersonation weak encryption configuration Unit Test
+tests:
+- name: Splunk protocol impersonation weak encryption configuration
+  file: application/splunk_protocol_impersonation_weak_encryption_configuration.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: splk_protocol_impersonation_weak_encryption_configuration.txt
+    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt
+    source: "/opt/splunk/var/log/splunk/splunkd.log"
+    sourcetype: splunkd