changednameofdetection

detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml

@@ -0,0 +1,44 @@
+name: Splunk protocol impersonation weak encryption simplerequest
+id: 839d12a6-b119-4d44-ac4f-13eed95412c8
+version: 1
+date: '2022-05-24'
+author: Rod Soto, Splunk
+type: Hunting
+datamodel: []
+search: '|splk_cert_validation_tls "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter'
+description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request.
+how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search.
+known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
+references:
+- https://www.splunk.com/en_us/product-security
+- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Failed to validate certificate on host$
+  mitre_attack_id:
+  -  T1588.004
+  observable:
+  - name: Hostname
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - host
+  - event_message
+  - path
+  risk_score: 40
+  security_domain: threat

macros/splk_cert_validation_tls.yml

@@ -0,0 +1,4 @@
+definition: index=_internal sourcetype=splunk_python source=/opt/splunk/var/log/splunk/python.log
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: splunk_protocol_impersonation_weak_encryption_simplerequest 

tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml

@@ -0,0 +1,12 @@
+name: Splunk protocol impersonation weak encryption simplerequest Unit Test
+tests:
+- name: Splunk protocol impersonation weak encryption simplerequest
+  file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt
+    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt
+    source: "/opt/splunk/var/log/splunk/splunkd.log"
+    sourcetype: splunkd