From acc83e574d2f3638556eab850d1ae2f704df4cb2 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 22 Aug 2023 16:07:12 -0700 Subject: [PATCH] more detection and documentation updates --- ...command_injection_via_external_lookups.yml | 50 ------------------- .../splunk_dos_via_printf_search_function.yml | 9 ++-- lookups/splunk_risky_command.csv | 3 +- 3 files changed, 8 insertions(+), 54 deletions(-) delete mode 100644 detections/application/splunk_command_injection_via_external_lookups.yml diff --git a/detections/application/splunk_command_injection_via_external_lookups.yml b/detections/application/splunk_command_injection_via_external_lookups.yml deleted file mode 100644 index 4cf99a8610..0000000000 --- a/detections/application/splunk_command_injection_via_external_lookups.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Splunk Interactive Use of runshellscript Command -id: 854e39a9-1c7d-4129-b189-ff6335d80c3c -version: 1 -date: '2023-08-21' -author: Rod Soto -status: production -type: Hunting -data_source: [] -description: This hunting search provides data on finding exploit attempts in Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. -search: '`audit_searches` search = "| *runshellscript* \"\"" | stats count by search user splunk_server | `splunk_interactive_use_of_runshellscript_command_filter`' -how_to_implement: This search requires web enabled interface and ability to search internal indexes. -known_false_positives: ??? -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: endpoint - confidence: 50 - impact: 50 - message: Possible command injection attack by $user$ against $splunk_server$ - mitre_attack_id: - - T1202 - observable: - - name: splunk_server - type: Hostname - role: - - Victim - - name: user - type: User Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - required_fields: - - method - - host - - uri_path - - clientip - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: data/runshellscript.txt - source: audittrail - sourcetype: audittrail - custom_index: _audit \ No newline at end of file diff --git a/detections/application/splunk_dos_via_printf_search_function.yml b/detections/application/splunk_dos_via_printf_search_function.yml index 43ca52d5c8..fbe968fa26 100644 --- a/detections/application/splunk_dos_via_printf_search_function.yml +++ b/detections/application/splunk_dos_via_printf_search_function.yml @@ -6,9 +6,10 @@ author: Rod Soto status: production type: Hunting data_source: [] -description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance. -search: '`audit_searches` sourcetype=audittrail search=*printf* search="| makeresults - count=* | eval x=\"q\" | fieldformat x=printf(\"x %.1000000000000A\",1)" | stats count by user splunk_server host search | `splunk_dos_via_printf_search_function_filter`' +description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance. +search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search_type="adhoc" search!="*audit_searches" + | stats count by user splunk_server host search + | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`' how_to_implement: This search requires the ability to search internal indexes. known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. references: @@ -20,6 +21,8 @@ tags: confidence: 100 impact: 100 message: Possible denial of service attack against $host$ + cve: + - CVE-2023-40594 mitre_attack_id: - T0814 observable: diff --git a/lookups/splunk_risky_command.csv b/lookups/splunk_risky_command.csv index 9f6e6665b0..bbbe99a30a 100644 --- a/lookups/splunk_risky_command.csv +++ b/lookups/splunk_risky_command.csv @@ -8,4 +8,5 @@ "*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" "*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" "*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" -"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935","" \ No newline at end of file +"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935","" +"*| *runshellscript* """"*", "runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards", "<8.1.14, <8.2.12, <9.0.6, <9.1.1", "CVE-2023-40598", " \ No newline at end of file