more detection and documentation updates

detections/application/splunk_command_injection_via_external_lookups.yml

@@ -1,50 +0,0 @@
-name: Splunk Interactive Use of runshellscript Command
-id: 854e39a9-1c7d-4129-b189-ff6335d80c3c
-version: 1
-date: '2023-08-21'
-author: Rod Soto
-status: production
-type: Hunting
-data_source: []
-description: This hunting search provides data on finding exploit attempts in Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
-search: '`audit_searches` search = "| *runshellscript* \"\""    | stats count by search user splunk_server | `splunk_interactive_use_of_runshellscript_command_filter`'
-how_to_implement: This search requires web enabled interface and ability to search internal indexes. 
-known_false_positives: ???
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: endpoint
-  confidence: 50
-  impact: 50
-  message: Possible command injection attack by $user$ against $splunk_server$
-  mitre_attack_id:
-  - T1202
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User Name
-    role:
-      - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 25
-  required_fields:
-  - method 
-  - host
-  - uri_path 
-  - clientip 
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: data/runshellscript.txt
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit

detections/application/splunk_dos_via_printf_search_function.yml

@@ -6,9 +6,10 @@ author: Rod Soto
 status: production
 type: Hunting
 data_source: []
-description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
-search: '`audit_searches` sourcetype=audittrail search=*printf* search="| makeresults
-  count=* | eval x=\"q\" | fieldformat x=printf(\"x %.1000000000000A\",1)" | stats count by user splunk_server host search | `splunk_dos_via_printf_search_function_filter`'
+description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
+search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search_type="adhoc" search!="*audit_searches" 
+  | stats count by user splunk_server host search 
+  | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
 how_to_implement: This search requires the ability to search internal indexes. 
 known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. 
 references:
@@ -20,6 +21,8 @@ tags:
   confidence: 100
   impact: 100
   message: Possible denial of service attack against $host$
+  cve:
+  - CVE-2023-40594
   mitre_attack_id:
   - T0814
   observable:

lookups/splunk_risky_command.csv

@@ -8,4 +8,5 @@
 "*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
 "*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
-"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
+"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
+"*| *runshellscript* """"*", "runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards", "<8.1.14, <8.2.12, <9.0.6, <9.1.1", "CVE-2023-40598", "