diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py b/bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py index 579ab37d72..a6e2ae5cf7 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py @@ -8,10 +8,16 @@ class CveEnrichment(): @classmethod def enrich_cve(self, cve_id: str) -> dict: - cve = CVESearch(CVESSEARCH_API_URL) - result = cve.id(cve_id) cve_enriched = dict() - cve_enriched['id'] = cve_id - cve_enriched['cvss'] = result['cvss'] - cve_enriched['summary'] = result['summary'] + try: + cve = CVESearch(CVESSEARCH_API_URL) + result = cve.id(cve_id) + cve_enriched['id'] = cve_id + cve_enriched['cvss'] = result['cvss'] + cve_enriched['summary'] = result['summary'] + except TypeError as TypeErr: + # there was a error calling the circl api lets just empty the object + print("WARNING, issue enriching {0}, with error: {1}".format(cve_id, str(TypeErr))) + cve_enriched = dict() + return cve_enriched \ No newline at end of file diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml new file mode 100644 index 0000000000..d2d9bbcb34 --- /dev/null +++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml @@ -0,0 +1,57 @@ +name: Splunk DoS via Malformed S2S Request +id: fc246e56-953b-40c1-8634-868f9e474cbd +version: 1 +date: '2022-03-24' +author: Lou Stella, Splunk +type: TTP +datamodel: [] +description: On March 24th, 2022, Splunk published a security advisory for a possible Denial of Service stemming from the lack of validation in a specific key-value field in the Splunk-to-Splunk (S2S) protocol. This detection will alert on attempted exploitation in patched versions of Splunk. +search: '`splunkd` log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | table host, src | `splunk_dos_via_malformed_s2s_request_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422. +known_false_positives: None. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html +tags: + analytic_story: + - Splunk Vulnerabilities + cve: + - CVE-2021-3422 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log + impact: 50 + kill_chain_phases: + - Exploitation + message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$ + mitre_attack_id: + - T1498 + nist: + - DE.CM + observable: + - name: host + type: Hostname + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - host + - src + - log_level + - component + - thread_name + risk_score: 50 + security_domain: threat diff --git a/detections/deprecated/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml index cb5861e8e5..87c328c19b 100644 --- a/detections/deprecated/open_redirect_in_splunk_web.yml +++ b/detections/deprecated/open_redirect_in_splunk_web.yml @@ -13,7 +13,7 @@ known_false_positives: None identified references: [] tags: analytic_story: - - Splunk Enterprise Vulnerability + - Splunk Vulnerabilities asset_type: Splunk Server cis20: - CIS 3 diff --git a/detections/deprecated/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml index b5dc3677c0..8e97f6508f 100644 --- a/detections/deprecated/splunk_enterprise_information_disclosure.yml +++ b/detections/deprecated/splunk_enterprise_information_disclosure.yml @@ -20,7 +20,7 @@ known_false_positives: Retrieving server information may be a legitimate API req references: [] tags: analytic_story: - - Splunk Enterprise Vulnerability CVE-2018-11409 + - Splunk Vulnerabilities asset_type: Splunk Server cis20: - CIS 3 diff --git a/macros/splunkd.yml b/macros/splunkd.yml new file mode 100644 index 0000000000..4967864d23 --- /dev/null +++ b/macros/splunkd.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunkd +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunkd \ No newline at end of file diff --git a/stories/deprecated/splunk_enterprise_vulnerability.yml b/stories/deprecated/splunk_enterprise_vulnerability.yml deleted file mode 100644 index 0ff703097d..0000000000 --- a/stories/deprecated/splunk_enterprise_vulnerability.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: Splunk Enterprise Vulnerability -id: 4e692b96-de2d-4bd1-9105-37e2368a8db1 -version: 1 -date: '2017-09-19' -author: Bhavin Patel, Splunk -type: batch -description: Keeping your Splunk deployment up to date is critical and may help you - reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some - older versions of Splunk Enterprise. The detection search will help ensure that - users are being properly authenticated and not being redirected to malicious domains. -narrative: 'This Analytic Story is associated with CVE-2016-4859, an open-redirect - vulnerability in the following versions of Splunk Enterprise:\ - - \ - - 1. Splunk Enterprise 6.4.x, prior to 6.4.3\ - - 1. Splunk Enterprise 6.3.x, prior to 6.3.6\ - - 1. Splunk Enterprise 6.2.x, prior to 6.2.10\ - - 1. Splunk Enterprise 6.1.x, prior to 6.1.11\ - - 1. Splunk Enterprise 6.0.x, prior to 6.0.12\ - - 1. Splunk Enterprise 5.0.x, prior to 5.0.16\ - - 1. Splunk Light, prior to 6.4.3CVE-2016-4859 allows attackers to redirect users - to arbitrary web sites and conduct phishing attacks via unspecified vectors. (Credit: - Noriaki Iwasaki, Cyber Defense Institute, Inc.).\ - - It is important to ensure that your Splunk deployment is being kept up to date and - is properly configured. This detection search allows analysts to monitor internal - logs to ensure users are properly authenticated and cannot be redirected to any - malicious third-party websites.' -references: -- http://www.splunk.com/view/SP-CAAAPQ6#announce -- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859 -tags: - analytic_story: Splunk Enterprise Vulnerability - category: - - Vulnerability - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - usecase: Security Monitoring diff --git a/stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml b/stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml deleted file mode 100644 index 29aa754be9..0000000000 --- a/stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Splunk Enterprise Vulnerability CVE-2018-11409 -id: 1fc34cbc-34e9-43ba-87ab-6811c9e95400 -version: 1 -date: '2018-06-14' -author: David Dorsey, Splunk -type: batch -description: Reduce the risk of CVE-2018-11409, an information disclosure vulnerability - within some older versions of Splunk Enterprise, with searches designed to help - ensure that your Splunk system does not leak information to authenticated users. -narrative: 'Although there have been no reports of it being exploited, Splunk Enterprise - versions through 7.0.1 reportedly have a vulnerability that may expose information - through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). - NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). - The REST endpoint that exposes system information is also necessary for the proper - operation of Splunk clustering and instrumentation. Customers should upgrade to - the latest version to reduce the risk of this vulnerability.\ - - Splunk Enterprise exposes partial information about the host operating system, hardware, - and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without - authentication. Splunk Enterprise 6.6.0 and later exposes this information only - to authenticated Splunk users. Based on the information exposure, Splunk characterizes - this issue as a low severity impact.\ - - Read more in Splunk''s official response: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings.\ - - A detection search within this Analytic Story looks for vulnerabilities described - in CVE-2018-11409: Information Exposure (https://nvd.nist.gov/vuln/detail/CVE-2018-11409). - If it turns up activities that may be specific, you can use the included investigative - searches to return information regarding web activity and network traffic by src_ip.' -references: -- https://nvd.nist.gov/vuln/detail/CVE-2018-11409 -- https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings -- https://www.exploit-db.com/exploits/44865/ -tags: - analytic_story: Splunk Enterprise Vulnerability CVE-2018-11409 - category: - - Vulnerability - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - usecase: Security Monitoring diff --git a/stories/living_off_the_land.yml b/stories/living_off_the_land.yml index 1e7dc547b2..741299fa9c 100644 --- a/stories/living_off_the_land.yml +++ b/stories/living_off_the_land.yml @@ -4,7 +4,7 @@ version: 2 date: '2022-03-16' author: Lou Stella, Splunk description: Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. -narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior. +narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior. references: - https://lolbas-project.github.io/ tags: diff --git a/stories/splunk_vulnerabilities.yml b/stories/splunk_vulnerabilities.yml new file mode 100644 index 0000000000..9e3d64107f --- /dev/null +++ b/stories/splunk_vulnerabilities.yml @@ -0,0 +1,19 @@ +name: Splunk Vulnerabilities +id: 5354df00-dce2-48ac-9a64-8adb48006828 +version: 1 +date: '2022-03-28' +author: Lou Stella, Splunk +description: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. +narrative: This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html +- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3422 +tags: + analytic_story: Splunk Vulnerabilities + category: + - Best Practices + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Application Security diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml new file mode 100644 index 0000000000..d2780a45e8 --- /dev/null +++ b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml @@ -0,0 +1,13 @@ +name: Splunk DoS via Malformed S2S Request Unit Test +tests: +- name: Splunk DoS via Malformed S2S Request + file: application/splunk_dos_via_malformed_s2s_request.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splunkd.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + update_timestamp: true