Branch was auto-updated.

bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py

@@ -8,10 +8,16 @@ class CveEnrichment():
 
     @classmethod
     def enrich_cve(self, cve_id: str) -> dict:
-        cve = CVESearch(CVESSEARCH_API_URL)
-        result = cve.id(cve_id)
         cve_enriched = dict()
-        cve_enriched['id'] = cve_id
-        cve_enriched['cvss'] = result['cvss']
-        cve_enriched['summary'] = result['summary']
+        try:
+            cve = CVESearch(CVESSEARCH_API_URL)
+            result = cve.id(cve_id)
+            cve_enriched['id'] = cve_id
+            cve_enriched['cvss'] = result['cvss']
+            cve_enriched['summary'] = result['summary']
+        except TypeError as TypeErr:
+            # there was a error calling the circl api lets just empty the object
+            print("WARNING, issue enriching {0}, with error: {1}".format(cve_id, str(TypeErr)))
+            cve_enriched = dict()
+    
         return cve_enriched

detections/application/splunk_dos_via_malformed_s2s_request.yml

@@ -0,0 +1,57 @@
+name: Splunk DoS via Malformed S2S Request
+id: fc246e56-953b-40c1-8634-868f9e474cbd
+version: 1
+date: '2022-03-24'
+author: Lou Stella, Splunk
+type: TTP
+datamodel: []
+description: On March 24th, 2022, Splunk published a security advisory for a possible Denial of Service stemming from the lack of validation in a specific key-value field in the Splunk-to-Splunk (S2S) protocol. This detection will alert on attempted exploitation in patched versions of Splunk. 
+search: '`splunkd` log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | table host, src | `splunk_dos_via_malformed_s2s_request_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422.
+known_false_positives: None.
+references:
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  cve: 
+  - CVE-2021-3422
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$
+  mitre_attack_id:
+  - T1498
+  nist:
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  - name: src 
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - host
+  - src
+  - log_level
+  - component
+  - thread_name
+  risk_score: 50
+  security_domain: threat

detections/deprecated/open_redirect_in_splunk_web.yml

@@ -13,7 +13,7 @@ known_false_positives: None identified
 references: []
 tags:
   analytic_story:
-  - Splunk Enterprise Vulnerability
+  - Splunk Vulnerabilities
   asset_type: Splunk Server
   cis20:
   - CIS 3

detections/deprecated/splunk_enterprise_information_disclosure.yml

@@ -20,7 +20,7 @@ known_false_positives: Retrieving server information may be a legitimate API req
 references: []
 tags:
   analytic_story:
-  - Splunk Enterprise Vulnerability CVE-2018-11409
+  - Splunk Vulnerabilities
   asset_type: Splunk Server
   cis20:
   - CIS 3

macros/splunkd.yml

@@ -0,0 +1,4 @@
+definition: index=_internal sourcetype=splunkd
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: splunkd

stories/deprecated/splunk_enterprise_vulnerability.yml

@@ -1,47 +0,0 @@
-name: Splunk Enterprise Vulnerability
-id: 4e692b96-de2d-4bd1-9105-37e2368a8db1
-version: 1
-date: '2017-09-19'
-author: Bhavin Patel, Splunk
-type: batch
-description: Keeping your Splunk deployment up to date is critical and may help you
-  reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some
-  older versions of Splunk Enterprise. The detection search will help ensure that
-  users are being properly authenticated and not being redirected to malicious domains.
-narrative: 'This Analytic Story is associated with CVE-2016-4859, an open-redirect
-  vulnerability in the following versions of Splunk Enterprise:\
-
-  \
-
-  1. Splunk Enterprise 6.4.x, prior to 6.4.3\
-
-  1. Splunk Enterprise 6.3.x, prior to 6.3.6\
-
-  1. Splunk Enterprise 6.2.x, prior to 6.2.10\
-
-  1. Splunk Enterprise 6.1.x, prior to 6.1.11\
-
-  1. Splunk Enterprise 6.0.x, prior to 6.0.12\
-
-  1. Splunk Enterprise 5.0.x, prior to 5.0.16\
-
-  1. Splunk Light, prior to 6.4.3CVE-2016-4859 allows attackers to redirect users
-  to arbitrary web sites and conduct phishing attacks via unspecified vectors. (Credit:
-  Noriaki Iwasaki, Cyber Defense Institute, Inc.).\
-
-  It is important to ensure that your Splunk deployment is being kept up to date and
-  is properly configured. This detection search allows analysts to monitor internal
-  logs to ensure users are properly authenticated and cannot be redirected to any
-  malicious third-party websites.'
-references:
-- http://www.splunk.com/view/SP-CAAAPQ6#announce
-- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859
-tags:
-  analytic_story: Splunk Enterprise Vulnerability
-  category:
-  - Vulnerability
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Security Monitoring

stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml

@@ -1,42 +0,0 @@
-name: Splunk Enterprise Vulnerability CVE-2018-11409
-id: 1fc34cbc-34e9-43ba-87ab-6811c9e95400
-version: 1
-date: '2018-06-14'
-author: David Dorsey, Splunk
-type: batch
-description: Reduce the risk of CVE-2018-11409, an information disclosure vulnerability
-  within some older versions of Splunk Enterprise, with searches designed to help
-  ensure that your Splunk system does not leak information to authenticated users.
-narrative: 'Although there have been no reports of it being exploited, Splunk Enterprise
-  versions through 7.0.1 reportedly have a vulnerability that may expose information
-  through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings).
-  NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409).
-  The REST endpoint that exposes system information is also necessary for the proper
-  operation of Splunk clustering and instrumentation. Customers should upgrade to
-  the latest version to reduce the risk of this vulnerability.\
-
-  Splunk Enterprise exposes partial information about the host operating system, hardware,
-  and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without
-  authentication. Splunk Enterprise 6.6.0 and later exposes this information only
-  to authenticated Splunk users. Based on the information exposure, Splunk characterizes
-  this issue as a low severity impact.\
-
-  Read more in Splunk''s official response: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings.\
-
-  A detection search within this Analytic Story looks for vulnerabilities described
-  in CVE-2018-11409: Information Exposure (https://nvd.nist.gov/vuln/detail/CVE-2018-11409).
-  If it turns up activities that may be specific, you can use the included investigative
-  searches to return information regarding web activity and network traffic by src_ip.'
-references:
-- https://nvd.nist.gov/vuln/detail/CVE-2018-11409
-- https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings
-- https://www.exploit-db.com/exploits/44865/
-tags:
-  analytic_story: Splunk Enterprise Vulnerability CVE-2018-11409
-  category:
-  - Vulnerability
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Security Monitoring

stories/living_off_the_land.yml

@@ -4,7 +4,7 @@ version: 2
 date: '2022-03-16'
 author: Lou Stella, Splunk
 description: Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. 
-narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
+narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
 references:
 - https://lolbas-project.github.io/
 tags:

stories/splunk_vulnerabilities.yml

@@ -0,0 +1,19 @@
+name: Splunk Vulnerabilities
+id: 5354df00-dce2-48ac-9a64-8adb48006828
+version: 1
+date: '2022-03-28'
+author: Lou Stella, Splunk
+description: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. 
+narrative:  This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. 
+references: 
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
+- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3422
+tags:
+  analytic_story: Splunk Vulnerabilities
+  category:
+  - Best Practices
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Application Security

tests/application/splunk_dos_via_malformed_s2s_request.test.yml

@@ -0,0 +1,13 @@
+name: Splunk DoS via Malformed S2S Request Unit Test
+tests:
+- name: Splunk DoS via Malformed S2S Request
+  file: application/splunk_dos_via_malformed_s2s_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: splunkd.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
+    source: /opt/splunk/var/log/splunk/splunkd.log
+    sourcetype: splunkd
+    update_timestamp: true