Branch was auto-updated.

bin/docker_detection_tester/modules/container_manager.py

@@ -294,7 +294,7 @@ class ContainerManager:
                     "that this could take a long time depending on your "
                     "connection. It's around 2GB."%(container_name))
                 pull_start_time = timeit.default_timer()
-                client.images.pull(container_name)
+                client.images.pull(container_name,platform="linux/amd64")
                 pull_finish_time = timeit.default_timer()
                 print("Successfully pulled the docker image [%s] in %ss"%
                     (container_name,

bin/docker_detection_tester/modules/splunk_container.py

@@ -184,6 +184,7 @@ class SplunkContainer:
             name=self.container_name,
             mounts=self.mounts,
             detach=True,
+            platform="linux/amd64"
         )
 
         return container

detections/application/splunk_dos_via_dump_spl_command.yml

@@ -0,0 +1,47 @@
+name: Splunk DOS Via Dump SPL Command
+id: fb0e6823-365f-48ed-b09e-272ac4c1dad6
+version: 1
+date: '2023-05-10'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- splunkd.log
+description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
+search: '`splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`'
+how_to_implement: This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults.
+known_false_positives: Segmentation faults may occur due to other causes, so this search may produce false positives 
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  atomic_guid: []
+  confidence: 100
+  impact: 100
+  message: Possible denial of service attack with Victim $host$
+  mitre_attack_id:
+  - T1499.004
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  risk_score: 100
+  required_fields:
+  - host 
+  - source 
+  - event_message
+  - status
+  - _time
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_dos_via_dump_spl_command.log
+    source: /opt/splunk/var/log/splunk/splunkd.log
+    sourcetype: splunkd_crash_log
+    custom_index: _internal

detections/application/splunk_edit_user_privilege_escalation.yml

@@ -0,0 +1,49 @@
+name: Splunk Edit User Privilege Escalation
+id: 39e1c326-67d7-4c0d-8584-8056354f6593
+version: 1
+date: '2023-05-23'
+author: Rod Soto, Chase Franklin
+status: production
+type: Hunting
+data_source:
+- audittrail
+description: A low-privilege user who holds a role that has the edit_user capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
+search: '`audittrail` action IN ("change_own_password","password_change","edit_password") AND info="granted" AND NOT user IN (admin, splunk-system-user) | stats earliest(_time) as event_time values(index) as index values(sourcetype) as sourcetype values(action) as action values(info) as info by user | `splunk_edit_user_privilege_escalation_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover abuse of edit_user privilege. 
+known_false_positives: This search may produce false positives as password changing actions may be part of normal behavior. Operator will need to investigate these actions in order to discern exploitation attempts. 
+references:
+- https://advisory.splunk.com/ 
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: endpoint
+  atomic_guid: []
+  confidence: 80
+  impact: 80
+  cve: []
+  message: Possible attempt to abuse edit_user function by $user$ 
+  mitre_attack_id:
+  - T1548
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 64
+  required_fields:
+  - user 
+  - action 
+  - info 
+  - _time 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_edit_user_privilege_escalation.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

detections/application/splunk_http_response_splitting_via_rest_spl_command.yml

@@ -0,0 +1,46 @@
+name: Splunk HTTP Response Splitting Via Rest SPL Command
+id: e615a0e1-a1b2-4196-9865-8aa646e1708c
+version: 1
+date: '2023-05-23'
+author: Rod Soto, Chase Franklin
+status: production
+type: Hunting
+data_source:
+- audittrail
+description: A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
+search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="index=_audit" | table user info has_error_msg search _time  | `splunk_http_response_splitting_via_rest_spl_command_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss. 
+known_false_positives: This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators. 
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: endpoint
+  atomic_guid: []
+  confidence: 50
+  impact: 50
+  message: Suspicious access by $user$
+  mitre_attack_id:
+  - T1027.006
+  observable:
+  - name: user
+    type: URL String
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  risk_score: 25
+  required_fields:
+  - search
+  - testing_endpoint 
+  - info 
+  - has_error_msg
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

detections/application/splunk_low_privilege_user_can_view_hashed_splunk_password.yml

@@ -0,0 +1,50 @@
+name: Splunk Low Privilege User Can View Hashed Splunk Password
+id: a1be424d-e59c-4583-b6f9-2dcc23be4875
+version: 1
+date: '2023-05-09'
+author: Rod Soto, Eric McGinnis, Chase Franklin
+status: production
+type: Hunting
+data_source:
+- splunk_web_access
+description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.
+search: '`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" | stats earliest(_time) as event_time values(method) as method values(status) as
+  status values(clientip) as clientip values(useragent) as useragent values(file) as file by user | convert ctime(*time) | `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content.
+known_false_positives: This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts.
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  atomic_guid: []
+  confidence: 90
+  impact: 90
+  message: Attempt to access Splunk hashed password file from $clientip$
+  mitre_attack_id:
+  - T1212
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker 
+  product:
+  - Splunk Enterprise
+  risk_score: 81
+  required_fields:
+  - _time  
+  - clientip 
+  - useragent 
+  - file 
+  - user 
+  - method 
+  - status 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/splunk/splunk_low_privilege_user_can_view_hashed_splunk_password.log
+    source: /opt/splunk/var/log/splunk/web_access.log
+    sourcetype: splunk_web_access
+    custom_index: _internal

detections/application/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml

@@ -0,0 +1,50 @@
+name: Splunk Path Traversal In Splunk App For Lookup File Edit
+id: 8ed58987-738d-4917-9e44-b8ef6ab948a6
+version: 1
+date: '2023-05-11'
+author: Rod Soto, Eric McGinnis
+status: production
+type: Hunting
+data_source:
+- splunkd_access 
+description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user with access to the Splunk App for Lookup File Editing can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory, including but not limited to the password hash file for the instance.
+search: '`splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file owner namespace  version | stats count by clientip namespace lookup_file uri_query | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection is meant for on premise environments,
+  and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
+known_false_positives: This search may find additional path traversal exploitation attempts or malformed requests.
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint 
+  atomic_guid: []
+  confidence: 80
+  impact: 50
+  message: Path traversal exploitation attempt from $clientip$
+  mitre_attack_id:
+  - T1083
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  risk_score: 40
+  required_fields:
+  - clientip
+  - uri_query 
+  - event_message 
+  - lookup_file 
+  - owner 
+  - method 
+  - user
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.log
+    source: splunkd_access 
+    sourcetype: splunkd_access
+    custom_index: _internal

detections/application/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml

@@ -0,0 +1,48 @@
+name: Splunk Persistent XSS Via URL Validation Bypass W Dashboard
+id: 8a43558f-a53c-4ee4-86c1-30b1e8ef3606
+version: 1
+date: '2023-05-09'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- splunk_web_access
+description: In Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13, a low-privileged user can bypass URL validation to perform a path traversal and access restricted and confidential information by targeting other users on the instance, including the admin user.  The only affected version of bootstrap which shipped with Splunk was version 2.3.1, so the search is targeted at that version alone.
+search: '`splunkd_web` method=GET uri_path="*bootstrap-2.3.1*" file="*.js" | table _time clientip uri_path file status | `splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter`'
+how_to_implement: This search does not require additional data to be ingested. This search requires ability to search _internal index. This search helps discover access to vulnerable bootstrap versions. 
+known_false_positives: This search will produce numerous false positives as it shows ANY accesses to vulnerable bootstrap Javascript files.  Accesses to these files occur during normal Splunk usage. To reduce or eliminate false positives, update the a version of Splunk which has addressed the vulnerability.
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  atomic_guid: []
+  confidence: 20
+  impact: 80
+  cve: 
+  - CVE-2019-8331
+  message:  Attempted access to vulnerable bootstrap file by $clientip$
+  mitre_attack_id:
+  - T1189
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  risk_score: 16
+  required_fields:
+  - file 
+  - uri 
+  - clientip 
+  - user 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.log
+    source: /opt/splunk/var/log/splunk/web_access.log
+    sourcetype: splunk_web_access
+    custom_index: _internal

detections/application/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml

@@ -0,0 +1,48 @@
+name: Splunk RBAC Bypass On Indexing Preview REST Endpoint
+id: bbe26f95-1655-471d-8abd-3d32fafa86f8
+version: 1
+date: '2023-05-10'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- splunkd_access.log
+description: An unauthorized user can use the /services/indexing/preview REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.
+search: '`splunkda` method="POST" uri="*/services/indexing/preview*" | table host clientip status useragent user uri_path | `splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter`'
+how_to_implement: This search does not require additional data ingestion. It requires the ability to search _internal index. 
+known_false_positives: This is a hunting search which provides verbose results against this endpoint. Operator must consider things such as IP address, useragent and user(specially low privelege) and host to investigate possible attack. 
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: endpoint
+  atomic_guid: []
+  confidence: 50
+  impact: 30
+  message: Review $clientip$ access to indexing preview endpoint from low privilege user
+  mitre_attack_id:
+  - T1134
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker 
+  product:
+  - Splunk Enterprise
+  risk_score: 15
+  required_fields:
+  - host 
+  - clientip 
+  - status 
+  - useragent 
+  - user 
+  - uri_path 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134/splunk/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.log
+    source: splunkd_access.log
+    sourcetype: splunkd_access
+    custom_index: _internal

detections/endpoint/windows_moveit_transfer_writing_aspx.yml

@@ -0,0 +1,72 @@
+name: Windows MOVEit Transfer Writing ASPX
+id: c0ed2aca-5666-45b3-813f-ddfac3f3eda0
+version: 1
+date: '2023-06-01'
+author: Michael Haag, Splunk
+status: experimental
+type: TTP
+data_source:
+- Sysmon Event ID 11
+description: This analytic detects the creation of new ASPX files in the MOVEit Transfer application's "wwwroot" directory. This activity is indicative of the recent critical vulnerability found in MOVEit Transfer, where threat actors have been observed exploiting a zero-day vulnerability to install a malicious ASPX file (e.g., "human2.aspx") in the wwwroot directory. The injected file could then be used to exfiltrate sensitive data, including user credentials and file metadata. The vulnerability affects the MOVEit Transfer managed file transfer software developed by Progress, a subsidiary of US-based Progress Software Corporation. This analytic requires endpoint data reflecting process and filesystem activity. The identified process must be responsible for the creation of new ASPX or ASHX files in the specified directory.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=System  by _time span=1h Processes.process_id Processes.process_name
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\MOVEitTransfer\\wwwroot\\*") Filesystem.file_name
+  IN("*.aspx", "*.ashx", "*.asp*") OR Filesystem.file_name IN ("human2.aspx","_human2.aspx") by _time span=1h Filesystem.dest Filesystem.file_create_time
+  Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
+  fields _time dest file_create_time file_name file_path process_name process_path
+  process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
+  process_name | `windows_moveit_transfer_writing_aspx_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
+  node.
+known_false_positives: The query is structured in a way that `action` (read, create)
+  is not defined. Review the results of this query, filter, and tune as necessary.
+  It may be necessary to generate this query specific to your endpoint product.
+references:
+  - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
+  - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/
+  - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/
+  - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/
+  - https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft
+tags:
+  analytic_story:
+  - MOVEit Transfer Critical Vulnerability
+  asset_type: Endpoint
+  atomic_guid: []
+  confidence: 100
+  impact: 100
+  message: The MOVEit application on $dest$ has written a new ASPX file to disk.
+  mitre_attack_id:
+  - T1190
+  - T1133
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 100
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.file_hash
+  - Filesystem.user
+  - Filesystem.file_create_time
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.dest
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/moveit_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

dev_ssa/endpoint/ssa___windows_powerview_ad_access_control_list_enumeration.yml

@@ -1,64 +0,0 @@
-name: Windows PowerView AD Access Control List Enumeration
-id: 2b301d6c-0527-4dbd-8d2d-5345bc4be0cf
-version: 1
-date: '2023-05-02'
-author: Mauricio Velazco, Splunk
-status: production
-type: TTP
-description: The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`. This commandlets
-  are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within 
-  the organizations network, such as domain controllers, users, groups, computers, shares, etc.  Maintaining Active Directory permissions is complicated and hard to manage, especially in complex 
-  and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged
-  by attackers to identify and exploit configuration weaknesses.
-data_source:
-- Powershell 4104
-search:
-  selection1:
-    process.cmd_line|re: 'get-objectacl'
-  selection2:
-    process.cmd_line|re: 'get-domainobjectacl'
-  condition: selection1 or selection2
-how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup here
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1078/002/
-- https://medium.com/r3d-buck3t/enumerating-access-controls-in-active-directory-c06e2efa8b89
-- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces
-- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainObjectAcl/
-tags:
-  analytic_story:
-  - Active Directory Privilege Escalation
-  asset_type: Endpoint
-  confidence: 50
-  impact: 40
-  message: PowerView AD acccess control list enumeration detected on $Computer$
-  mitre_attack_id:
-  - T1078.002
-  - T1069
-  observable:
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - EventCode
-  - ScriptBlockText
-  - Opcode
-  - Computer
-  - UserID
-  kill_chain_phases:
-  - Exploitation
-  risk_score: 20
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell.log
-    source: XmlWinEventLog
-    sourcetype: XmlWinEventLog
-    update_timestamp: true

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "4.3.0"
+      "version": "4.4.1"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-30T18:06:50 UTC
+# On Date: 2023-06-01T23:44:19 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -375,6 +375,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization"], "mit
 known_false_positives = None at this time
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk DOS Via Dump SPL Command - Rule]
+type = detection
+asset_type = endpoint
+confidence = medium
+explanation = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
+how_to_implement = This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499.004"], "nist": ["DE.AE"]}
+known_false_positives = Segmentation faults may occur due to other causes, so this search may produce false positives
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk DoS via Malformed S2S Request - Rule]
 type = detection
 asset_type = Endpoint
@@ -385,6 +395,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = None.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk Edit User Privilege Escalation - Rule]
+type = detection
+asset_type = endpoint
+confidence = medium
+explanation = A low-privilege user who holds a role that has the edit_user capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
+how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover abuse of edit_user privilege.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"]}
+known_false_positives = This search may produce false positives as password changing actions may be part of normal behavior. Operator will need to investigate these actions in order to discern exploitation attempts.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule]
 type = detection
 asset_type = Endpoint
@@ -395,6 +415,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = This search may reveal non malicious zip files causing errors as well.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule]
+type = detection
+asset_type = endpoint
+confidence = medium
+explanation = A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
+how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.006"], "nist": ["DE.AE"]}
+known_false_positives = This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule]
 type = detection
 asset_type = Endpoint
@@ -415,6 +445,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
 known_false_positives = It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above.  If a user is not believed to be legitimate, then further investigation should take place.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule]
+type = detection
+asset_type = endpoint
+confidence = medium
+explanation = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.
+how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1212"], "nist": ["DE.AE"]}
+known_false_positives = This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule]
+type = detection
+asset_type = endpoint
+confidence = medium
+explanation = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user with access to the Splunk App for Lookup File Editing can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory, including but not limited to the password hash file for the instance.
+how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"]}
+known_false_positives = This search may find additional path traversal exploitation attempts or malformed requests.
+providing_technologies = null
+
 [savedsearch://ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule]
 type = detection
 asset_type = Endpoint
@@ -425,6 +475,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
 known_false_positives = This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule]
+type = detection
+asset_type = endpoint
+confidence = medium
+explanation = In Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13, a low-privileged user can bypass URL validation to perform a path traversal and access restricted and confidential information by targeting other users on the instance, including the admin user.  The only affected version of bootstrap which shipped with Splunk was version 2.3.1, so the search is targeted at that version alone.
+how_to_implement = This search does not require additional data to be ingested. This search requires ability to search _internal index. This search helps discover access to vulnerable bootstrap versions.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+known_false_positives = This search will produce numerous false positives as it shows ANY accesses to vulnerable bootstrap Javascript files.  Accesses to these files occur during normal Splunk usage. To reduce or eliminate false positives, update the a version of Splunk which has addressed the vulnerability.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
 type = detection
 asset_type = Endpoint
@@ -465,6 +525,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization"], "mit
 known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
 providing_technologies = null
 
+[savedsearch://ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule]
+type = detection
+asset_type = endpoint
+confidence = medium
+explanation = An unauthorized user can use the /services/indexing/preview REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.
+how_to_implement = This search does not require additional data ingestion. It requires the ability to search _internal index.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134"], "nist": ["DE.AE"]}
+known_false_positives = This is a hunting search which provides verbose results against this endpoint. Operator must consider things such as IP address, useragent and user(specially low privelege) and host to investigate possible attack.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule]
 type = detection
 asset_type = Endpoint
@@ -15096,7 +15166,7 @@ version = 1
 references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
+searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DOS Via Dump SPL Command - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Edit User Privilege Escalation - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule", "ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
 description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
 narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.
 

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 14375
+build = 14503
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 4.3.0
+version = 4.4.1
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-30T18:06:50 UTC
+# On Date: 2023-06-01T23:44:19 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 4.3.0
+version = 4.4.1

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-30T18:06:50 UTC
+# On Date: 2023-06-01T23:44:19 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-30T18:06:50 UTC
+# On Date: 2023-06-01T23:44:19 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -145,14 +145,26 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_dos_via_dump_spl_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_dos_via_malformed_s2s_request_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_edit_user_privilege_escalation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_endpoint_denial_of_service_dos_zip_bomb_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_http_response_splitting_via_rest_spl_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_improperly_formatted_parameter_crashes_splunkd_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -161,10 +173,22 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_low_privilege_user_can_view_hashed_splunk_password_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [persistent_xss_in_rapiddiag_through_user_interface_views_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_process_injection_forwarder_bundle_downloads_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -181,6 +205,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5214,6 +5242,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = index=_audit sourcetype=audittrail action=search
 description = Macro to enable easy searching of audittrail logs for searches
 
+[audittrail]
+definition = index=_audit sourcetype=audittrail
+description = Macro to enable easy searching of audittrail logs
+
 [aws_cloudwatchlogs_eks]
 definition = sourcetype="aws:cloudwatchlogs:eks"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -5771,6 +5803,10 @@ description = search data model's summaries only
 definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
 description = This macro is a list of AWS event names associated with security groups
 
+[splunk_crash_log]
+definition = (index=_internal AND sourcetype=splunkd_crash_log)
+description = Searches through the Splunk Crash Log for low-level errors and crashes
+
 [splunk_python]
 definition = index=_internal sourcetype=splunk_python
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

dist/escu/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-30T18:06:50 UTC
+# On Date: 2023-06-01T23:44:19 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1483,6 +1483,41 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`
 
+[ESCU - Splunk DOS Via Dump SPL Command - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499.004"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
+action.escu.how_to_implement = This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults.
+action.escu.known_false_positives = Segmentation faults may occur due to other causes, so this search may produce false positives
+action.escu.creation_date = 2023-05-10
+action.escu.modification_date = 2023-05-10
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk DOS Via Dump SPL Command - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk DOS Via Dump SPL Command - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499.004"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`
+
 [ESCU - Splunk DoS via Malformed S2S Request - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1529,6 +1564,41 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`
 
+[ESCU - Splunk Edit User Privilege Escalation - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = A low-privilege user who holds a role that has the edit_user capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = A low-privilege user who holds a role that has the edit_user capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
+action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover abuse of edit_user privilege.
+action.escu.known_false_positives = This search may produce false positives as password changing actions may be part of normal behavior. Operator will need to investigate these actions in order to discern exploitation attempts.
+action.escu.creation_date = 2023-05-23
+action.escu.modification_date = 2023-05-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Edit User Privilege Escalation - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Edit User Privilege Escalation - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `audittrail` action IN ("change_own_password","password_change","edit_password") AND info="granted" AND NOT user IN (admin, splunk-system-user) | stats earliest(_time) as event_time values(index) as index values(sourcetype) as sourcetype values(action) as action values(info) as info by user | `splunk_edit_user_privilege_escalation_filter`
+
 [ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1575,6 +1645,41 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary* |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`
 
+[ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.006"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
+action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss.
+action.escu.known_false_positives = This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators.
+action.escu.creation_date = 2023-05-23
+action.escu.modification_date = 2023-05-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.006"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="index=_audit" | table user info has_error_msg search _time  | `splunk_http_response_splitting_via_rest_spl_command_filter`
+
 [ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1656,6 +1761,76 @@ realtime_schedule = 0
 is_visible = false
 search = | rest splunk_server=local /services/authentication/users |search capabilities=admin* OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server | `splunk_list_all_nonstandard_admin_accounts_filter`
 
+[ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1212"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.
+action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content.
+action.escu.known_false_positives = This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts.
+action.escu.creation_date = 2023-05-09
+action.escu.modification_date = 2023-05-09
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1212"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" | stats earliest(_time) as event_time values(method) as method values(status) as status values(clientip) as clientip values(useragent) as useragent values(file) as file by user | convert ctime(*time) | `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`
+
+[ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user with access to the Splunk App for Lookup File Editing can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory, including but not limited to the password hash file for the instance.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user with access to the Splunk App for Lookup File Editing can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory, including but not limited to the password hash file for the instance.
+action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
+action.escu.known_false_positives = This search may find additional path traversal exploitation attempts or malformed requests.
+action.escu.creation_date = 2023-05-11
+action.escu.modification_date = 2023-05-11
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file owner namespace  version | stats count by clientip namespace lookup_file uri_query | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`
+
 [ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1702,6 +1877,41 @@ realtime_schedule = 0
 is_visible = false
 search = `audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/* action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`
 
+[ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13, a low-privileged user can bypass URL validation to perform a path traversal and access restricted and confidential information by targeting other users on the instance, including the admin user.  The only affected version of bootstrap which shipped with Splunk was version 2.3.1, so the search is targeted at that version alone.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = In Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13, a low-privileged user can bypass URL validation to perform a path traversal and access restricted and confidential information by targeting other users on the instance, including the admin user.  The only affected version of bootstrap which shipped with Splunk was version 2.3.1, so the search is targeted at that version alone.
+action.escu.how_to_implement = This search does not require additional data to be ingested. This search requires ability to search _internal index. This search helps discover access to vulnerable bootstrap versions.
+action.escu.known_false_positives = This search will produce numerous false positives as it shows ANY accesses to vulnerable bootstrap Javascript files.  Accesses to these files occur during normal Splunk usage. To reduce or eliminate false positives, update the a version of Splunk which has addressed the vulnerability.
+action.escu.creation_date = 2023-05-09
+action.escu.modification_date = 2023-05-09
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 20, "cve": ["CVE-2019-8331"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkd_web` method=GET uri_path="*bootstrap-2.3.1*" file="*.js" | table _time clientip uri_path file status | `splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter`
+
 [ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1842,6 +2052,41 @@ realtime_schedule = 0
 is_visible = false
 search = `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`
 
+[ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = An unauthorized user can use the /services/indexing/preview REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = An unauthorized user can use the /services/indexing/preview REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.
+action.escu.how_to_implement = This search does not require additional data ingestion. It requires the ability to search _internal index.
+action.escu.known_false_positives = This is a hunting search which provides verbose results against this endpoint. Operator must consider things such as IP address, useragent and user(specially low privelege) and host to investigate possible attack.
+action.escu.creation_date = 2023-05-10
+action.escu.modification_date = 2023-05-10
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkda` method="POST" uri="*/services/indexing/preview*" | table host clientip status useragent user uri_path | `splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter`
+
 [ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule]
 action.escu = 0
 action.escu.enabled = 1

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-30T18:06:50 UTC
+# On Date: 2023-06-01T23:44:19 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-30T18:06:50 UTC
+# On Date: 2023-06-01T23:44:19 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/ssa/srs/ssa___windows_powerview_ad_access_control_list_enumeration.yml

@@ -1,109 +0,0 @@
-name: Windows PowerView AD Access Control List Enumeration
-id: 2b301d6c-0527-4dbd-8d2d-5345bc4be0cf
-version: 1
-description: The following analytic leverages Event ID 4104 to identify the execution
-  of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`.
-  This commandlets are used to enumerate Access Control List permissions given to
-  Active Directory objects. In an active directory environment, an object is an entity
-  that represents an available resource within the organizations network, such as
-  domain controllers, users, groups, computers, shares, etc.  Maintaining Active Directory
-  permissions is complicated and hard to manage, especially in complex and large environments
-  with multiple domains. Weak permissions may allow adversaries and red teamers to
-  escalate their privileges in Active Directory. PowerView is a common tool leveraged
-  by attackers to identify and exploit configuration weaknesses.
-search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
-  null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
-  null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
-  device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
-  "string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
-  any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
-  null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
-  | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
-  eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line,
-  /(?i)get-objectacl/)=true OR match_regex(process_cmd_line, /(?i)get-domainobjectacl/)=true
-  
-  | eval body=create_map(
-    "devices", [
-        create_map(
-            "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
-        )
-    ],
-    "time", timestamp,
-    "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid),
-    "message", concat("Windows PowerView AD Access Control List Enumeration has been triggered on ", device_hostname, " by ", "Unknown", "."),
-    "users", [
-        create_map(
-            "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null)
-        )
-    ],
-    "activity_id", 1,
-    "category_uid", 2,
-    "class_uid", 102001,
-    "risk_level_id", 1,
-    "risk_score", 20,
-    "severity_id", 0,
-    "rule", create_map("name", "Windows PowerView AD Access Control List Enumeration", "uid", "2b301d6c-0527-4dbd-8d2d-5345bc4be0cf", "type", "Streaming"),
-    "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
-    "type_uid", 10200101,
-    "start_time", timestamp,
-    "end_time", timestamp
-  )
-  | into write_ba_finding_events();'
-how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup here
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators may leverage PowerView for legitimate purposes,
-  filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1078/002/
-- https://medium.com/r3d-buck3t/enumerating-access-controls-in-active-directory-c06e2efa8b89
-- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces
-- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainObjectAcl/
-tags:
-  required_fields:
-  - device.hostname
-  - process.file.path
-  - process.uid
-  - process.cmd_line
-  - actor.user.uid
-  risk_score: 20
-  security_domain: endpoint
-  risk_severity: low
-  research_site_url: https://research.splunk.com/endpoint/2b301d6c-0527-4dbd-8d2d-5345bc4be0cf/
-  event_schema: ocsf
-  mappings:
-  - ocsf: device.hostname
-    cim: dest
-  - ocsf: process.file.path
-    cim: process_path
-  - ocsf: process.uid
-    cim: process_id
-  - ocsf: process.cmd_line
-    cim: process
-  - ocsf: actor.user.uid
-    cim: user_id
-  annotations:
-    analytic_story:
-    - Active Directory Privilege Escalation
-    cis20:
-    - CIS 10
-    kill_chain_phases:
-    - Exploitation
-    - Delivery
-    - Installation
-    mitre_attack_id:
-    - T1078.002
-    - T1069
-    nist:
-    - DE.CM
-test:
-  name: Windows PowerView AD Access Control List Enumeration Unit Test
-  tests:
-  - name: Windows PowerView AD Access Control List Enumeration
-    attack_data:
-    - file_name: windows-powershell.log
-      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell.log
-      source: XmlWinEventLog
-runtime: SPL-DSP

macros/audittrail.yml

@@ -0,0 +1,3 @@
+definition: index=_audit sourcetype=audittrail
+description: Macro to enable easy searching of audittrail logs
+name: audittrail

macros/splunk_crash_log.yml

@@ -0,0 +1,3 @@
+definition: (index=_internal AND sourcetype=splunkd_crash_log)
+description: Searches through the Splunk Crash Log for low-level errors and crashes
+name: splunk_crash_log

requirements.txt

@@ -1,12 +1,12 @@
 attackcti==0.3.9
-docker==6.0.0
+docker==6.1.3
 GitPython==3.1.31
 Jinja2==3.1.2
 jsonschema==4.17.3
 mock==4.0.3
 psutil==5.9.5
 pycvesearch==1.2
-pydantic==1.10.7
+pydantic==1.10.8
 pysigma==0.9.8
 pysigma-backend-splunk==1.0.2
 pytest==7.3.1

ssa_detections/endpoint/ssa___windows_powerview_ad_access_control_list_enumeration.yml

@@ -1,90 +0,0 @@
-name: Windows PowerView AD Access Control List Enumeration
-id: 2b301d6c-0527-4dbd-8d2d-5345bc4be0cf
-version: 1
-date: '2023-05-02'
-author: Mauricio Velazco, Splunk
-type: TTP
-status: production
-description: The following analytic leverages Event ID 4104 to identify the execution
-  of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`.
-  This commandlets are used to enumerate Access Control List permissions given to
-  Active Directory objects. In an active directory environment, an object is an entity
-  that represents an available resource within the organizations network, such as
-  domain controllers, users, groups, computers, shares, etc.  Maintaining Active Directory
-  permissions is complicated and hard to manage, especially in complex and large environments
-  with multiple domains. Weak permissions may allow adversaries and red teamers to
-  escalate their privileges in Active Directory. PowerView is a common tool leveraged
-  by attackers to identify and exploit configuration weaknesses.
-data_source:
-- Powershell 4104
-search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
-  null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
-  null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
-  device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
-  "string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
-  any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
-  null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
-  | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
-  eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line,
-  /(?i)get-objectacl/)=true OR match_regex(process_cmd_line, /(?i)get-domainobjectacl/)=true
-  --finding_report--'
-how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup here
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators may leverage PowerView for legitimate purposes,
-  filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1078/002/
-- https://medium.com/r3d-buck3t/enumerating-access-controls-in-active-directory-c06e2efa8b89
-- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces
-- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainObjectAcl/
-tags:
-  analytic_story:
-  - Active Directory Privilege Escalation
-  asset_type: Endpoint
-  confidence: 50
-  impact: 40
-  message: PowerView AD acccess control list enumeration detected on $Computer$
-  mitre_attack_id:
-  - T1078.002
-  - T1069
-  observable:
-  - name: device.hostname
-    type: Hostname
-  - name: process.file.path
-    type: File
-  - name: process.uid
-    type: Other
-  - name: process.cmd_line
-    type: Other
-  - name: actor.user.uid
-    type: Other
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - device.hostname
-  - process.file.path
-  - process.uid
-  - process.cmd_line
-  - actor.user.uid
-  risk_score: 20
-  security_domain: endpoint
-  mappings:
-  - ocsf: device.hostname
-    cim: dest
-  - ocsf: process.file.path
-    cim: process_path
-  - ocsf: process.uid
-    cim: process_id
-  - ocsf: process.cmd_line
-    cim: process
-  - ocsf: actor.user.uid
-    cim: user_id
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell.log
-    source: XmlWinEventLog
-    sourcetype: XmlWinEventLog

stories/moveit_transfer_critical_vulnerability.yml

@@ -0,0 +1,31 @@
+name: MOVEit Transfer Critical Vulnerability
+id: e8c05f9b-6ad4-45ac-8f5d-ff044da417c9
+version: 1
+date: '2023-06-01'
+author: Michael Haag, Splunk
+description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEitTransfer\wwwroot\ folder for unusual files. A patch is currently being tested.
+narrative: 'Hackers have been actively exploiting a zero-day vulnerability found in the MOVEit Transfer software. This software, developed by Progress Software Corporation, a US-based company and its subsidiary Ipswitch, is a managed file transfer solution. It is used by thousands of organizations worldwide, including Chase, Disney, GEICO, and MLB, and by 3.5 million developers. The software allows for secure file transfers between business partners and customers using SFTP, SCP, and HTTP-based uploads.\
+
+  The zero-day vulnerability has been exploited to steal data on a large scale from various organizations. The identity of the threat actors and the exact timeline of the exploitation remains unclear. However, it has been confirmed that multiple organizations have experienced breaches and data theft.\
+
+  In response to this critical situation, Progress released a security advisory warning customers of the vulnerability and providing mitigation strategies while a patch is being developed and tested. They urged customers to take immediate action to protect their MOVEit environments. They suggested blocking external traffic to ports 80 and 445 on the MOVEit server and checking the c:\MOVEitTransfer\wwwroot\ folder for unexpected files, including backups or large file downloads.\
+
+  Blocking these ports will prevent external access to the web UI, prevent some MOVEit Automation tasks from working, block APIs, and prevent the Outlook MOVEit plugin from working. However, SFTP and FTP/s protocols can continue to be used for file transfers.\
+
+  There is currently no detailed information about the zero-day vulnerability. But based on the ports blocked and the specific location to check for unusual files, the flaw is likely a web-facing vulnerability.\
+  
+  While Progress has not officially confirmed that the vulnerability is being actively exploited, it is clear from several reports that multiple organizations have already had data stolen using this zero-day vulnerability. The exploitation appears very similar to the mass exploitation of a GoAnywhere MFT zero-day in January 2023 and the December 2020 zero-day exploitation of Accellion FTA servers. These were both managed file transfer platforms heavily exploited by the Clop ransomware gang to steal data and extort organizations.'
+references:
+  - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
+  - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/
+  - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/
+  - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/
+tags:
+  analytic_story: MOVEit Transfer Critical Vulnerability
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection