detectionsforlocalprivescpathtraversal

detections/application/local_privesc_via_nodejs_default_path.yml

@@ -0,0 +1,49 @@
+name: Local privesc via nodejs default path
+id: b2d7bdef-3650-415e-a4f7-85e6d6829472
+version: 1
+date: '2022-04-29'
+author: Rod Soto, Splunk
+type: TTP
+datamodel: []
+description: On May 3rd, 2022, Splunk published a security advisory for a privilege escalation vulnerability via Nodejs Default path. This vulnerability affects Windows and Unix based systems, and it allows a local low privilege user to gain SYSTEM in windows systems and in Unix based system the impact is lower as standard users cannot write under /opt directory.
+search: '`local_privesc_nodejs_splunk` search= makeresults | eval t= printf(\"*\") roles=user provenance=UI:Dashboard:* | stats count by action user savedsearch_name search | `local_privesc_via_nodejs_default_path_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search will provide users executing potentially exploitable command functionat search function.
+known_false_positives: In addition to the above search, the following search 'index=_internal pdf source="c:\\opt\\splunk\\var\\log\\splunk\\pdfgen.log" | table splunk_server filename date_mday date_hour' will provide time and document exported to PDF in order to find out low privilege user executing vulnerable function plus the export to PDF to complete exploit.
+references:
+  - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+  - CVE-2021-42743
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/local_privesc_via_nodes_default_path.txt
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A potential exploitable function has been executed by $user$
+  mitre_attack_id:
+  - T1548
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - search
+  - roles
+  - provenance
+  risk_score: 40
+  security_domain: threat

detections/application/path_traversal_spl_injection.yml

@@ -0,0 +1,53 @@
+name: Path traversal SPL injection
+id: dfe55688-82ed-4d24-a21b-ed8f0e0fda99
+version: 1
+date: '2022-04-29'
+author: Rod Soto, Splunk
+type: TTP
+datamodel: []
+search: ' `path_traversal_spl_injection` |search= "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/"  | stats count by s status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`'
+description: On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries.
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts.
+known_false_positives: This search may find additional path traversal exploitation attempts.
+references:
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+  - CVE-2022-26889
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Path traversal exploitation attempt from $clientip$
+  mitre_attack_id:
+  - T1083
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - source
+  - s
+  - status
+  - clientip
+  - method
+  - uri_path
+  - uri_query
+  risk_score: 40
+  security_domain: threat

detections/application/splunk_xss_in_monitoring_console.yml

@@ -7,15 +7,15 @@ type: TTP
 datamodel: []
 description: On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Site Scripting (XSS) vulnerability stemming from the lack of input validation in the Distributed Monitoring Console app. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk.
 search: ' `splunkd_web` method="GET" uri_query="description=%3C*" | table _time host status clientip user uri | `splunk_xss_in_monitoring_console_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. 
-known_false_positives: Use of the monitoring console where the less-than sign (<) is the first character in the description field. 
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183.
+known_false_positives: Use of the monitoring console where the less-than sign (<) is the first character in the description field.
 references:
 - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html
 tags:
   analytic_story:
   - Splunk Vulnerabilities
   asset_type: Endpoint
-  cve: 
+  cve:
   - CVE-2022-27183
   cis20:
   - CIS 3
@@ -44,7 +44,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - method 
+  - method
   - uri_query
   - status
   - clientip

macros/local_privesc_nodejs_splunk.yml

@@ -0,0 +1,4 @@
+definition: index=_audit sourcetype=audittrail 
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: local_privesc_nodejs_splunk

macros/path_traversal_spl_injection.yml

@@ -0,0 +1,4 @@
+definition: index=_internal sourcetype=splunkd_ui_access source="c:\\opt\\splunk\\var\\log\\splunk\\splunkd_ui_access.log"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: path_traversal_spl_injection

tests/application/local_privesc_via_nodejs_default_path.test.yml

@@ -0,0 +1,12 @@
+name: Local privesc via nodejs default path Unit Test
+tests:
+- name: Local privesc via nodejs default path
+  file: application/local_privesc_via_nodejs_default_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: local_privesc_via_nodes_default_path.txt
+    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/local_privesc_via_nodes_default_path.txt
+    source: audittrail
+    sourcetype: audittrail

tests/application/path_traversal_spl_injection.test.yml

@@ -0,0 +1,12 @@
+name: Path traversal SPL injection Unit Test
+tests:
+- name: Path traversal SPL injection
+  file: application/path_traversal_spl_injection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: path_traversal_spl_injection.txt
+    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt
+    source: c:\opt\splunk\var\log\splunk\splunkd_ui_access.log
+    sourcetype: splunkd_ui_access