Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2023-02-14 09:54:10 -08:00
parent 3bdd258a36 4ce75dac95
commit c44d599d2f
15 changed files with 446 additions and 25 deletions
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS-ContentUpdate", 
-      "version": "3.58.0"
+      "version": "3.59.0"
    }, 
    "author": [
      {
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-07T22:09:12 UTC
+# On Date: 2023-02-14T17:42:34 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -57,6 +57,16 @@ annotations = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
 providing_technologies = null

+[savedsearch://ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the kvstore_client endpoint allows for updating SSG KV store collections via a GET request. SSG is a Splunk Built app included by default with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled. This hunting search provides information on affected server specific method and post data that may reveal exploitation of this vulnerability.
+how_to_implement = Requires access to internal index.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule]
 type = detection
 asset_type = Endpoint
@@ -107,6 +117,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This search may reveal non malicious zip files causing errors as well.
 providing_technologies = null

+[savedsearch://ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, when the INGEST\\_EVAL parameter is improperly formatted, it crashes splunkd. This hunting search provides the user, timing and number of times the crashing command was executed.
+how_to_implement = Requires access to audittrail and use of Splunk_Audit.Search_Activity datamodel.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1499"], "nist": ["DE.CM"]}
+known_false_positives = This is a hunting search it should be focused on affected products, otherwise it is likely to produce false positives.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0. This search provides information on what user may have potentially added a malicious payload and what users were exposed to it.
+how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
 type = detection
 asset_type = Endpoint
@@ -167,6 +197,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This search may produce false positives as it is difficult to pinpoint all possible XSS injection characters in a single search string. Special attention is required to "en-US/list/entities/x/ui/views" which is the vulnerable injection point.
 providing_technologies = null

+[savedsearch://ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = In February 2023, Splunk disclosed several vulnerabilities affecting Splunk Enterprise commands deemed risky. The following hunting search includes the following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10), pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below 8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more information please review Splunk Vulnerabilities Disclosure, February 2023. Link can be found in reference.
+how_to_implement = Requires implementation of Splunk_Audit.Search_Activity datamodel.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.CM"]}
+known_false_positives = This search encompasses many commands.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Stored XSS via Data Model objectName field - Rule]
 type = detection
 asset_type = Endpoint
@@ -177,6 +217,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point.
 providing_technologies = null

+[savedsearch://ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table uploads let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now only be one of .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gz. This search provides user activity focus on uploads which aims to help hunt for malicious file uploads.
+how_to_implement = Requires access to internal splunkd_access.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = This is a hunting search, the search provides information on upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary after executing search. This search will produce false positives as payload cannot be directly discerned.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk User Enumeration Attempt - Rule]
 type = detection
 asset_type = endpoint
@@ -197,6 +247,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances.
 providing_technologies = null

+[savedsearch://ESCU - Splunk XSS via View - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled. This hunting search shows users action, application and role used for creating views related to this vulnerability.
+how_to_implement = This data is collected by default in Splunk.  Upon first enabling this rule, a number of errors may be observed. Those that are due to improperly formatted, but non-nefarious, XML views should be be remedied in the corresponding view. Please take care investigating potential XSS as accessing an affected page could retrigger the exploit.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = The error detected above can be generated for a wide variety of improperly formatted XML views.  There will be false positives as the search cannot extract the malicious payload and the view should be manually investigated.
+providing_technologies = null
+
 [savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
 type = detection
 asset_type = AWS Instance
@@ -10546,6 +10606,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Not all exports and downloads are malicious, special attention must be put as well on /en-US/splunkd/__raw/services/pdfgen/render in the context of this search.
 providing_technologies = null

+[savedsearch://ESCU - Splunk list all nonstandard admin accounts - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This search will enumerate all Splunk Accounts with administrative rights on this instance.  It deliberately ignores the default admin account since this is assumed to be present.  This search may help in a detection the Cross-Site Scripting Attack listed: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled.
+how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures.  If there have been admin account, in addition to the standard admin account, intentionally created on this server, then edit the filter macro to exclude them.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+known_false_positives = It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above.  If a user is not believed to be legitimate, then further investigation should take place.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk XSS in Monitoring Console - Rule]
 type = detection
 asset_type = Endpoint
@@ -13494,7 +13564,7 @@ version = 1
 references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
+searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
 description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
 narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 12012
+build = 12078

 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple

 [launcher]
 author = Splunk
-version = 3.58.0
+version = 3.59.0
 description = Explore the Analytic Stories included with ES Content Updates.

 [ui]
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-07T22:09:12 UTC
+# On Date: 2023-02-14T17:42:34 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.58.0
+version = 3.59.0
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-07T22:09:12 UTC
+# On Date: 2023-02-14T17:42:34 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-07T22:09:12 UTC
+# On Date: 2023-02-14T17:42:34 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -25,6 +25,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -45,6 +49,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_improperly_formatted_parameter_crashes_splunkd_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[persistent_xss_in_rapiddiag_through_user_interface_views_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_process_injection_forwarder_bundle_downloads_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -69,10 +81,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_risky_command_abuse_disclosed_february_2023_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_stored_xss_via_data_model_objectname_field_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_user_enumeration_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -81,6 +101,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_xss_via_view_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4141,6 +4165,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_list_all_nonstandard_admin_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_xss_in_monitoring_console_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-07T22:09:12 UTC
+# On Date: 2023-02-14T17:42:34 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -213,6 +213,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`

+[ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the kvstore_client endpoint allows for updating SSG KV store collections via a GET request. SSG is a Splunk Built app included by default with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled. This hunting search provides information on affected server specific method and post data that may reveal exploitation of this vulnerability.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the kvstore_client endpoint allows for updating SSG KV store collections via a GET request. SSG is a Splunk Built app included by default with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled. This hunting search provides information on affected server specific method and post data that may reveal exploitation of this vulnerability.
+action.escu.how_to_implement = Requires access to internal index.
+action.escu.known_false_positives = This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives.
+action.escu.creation_date = 2023-02-14
+action.escu.modification_date = 2023-02-14
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Potential CSRF exploitation attempt from $host$
+action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "cve": ["CVE-2023-22942"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the kvstore_client endpoint allows for updating SSG KV store collections via a GET request. SSG is a Splunk Built app included by default with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled. This hunting search provides information on affected server specific method and post data that may reveal exploitation of this vulnerability.
+action.notable.param.rule_title = Splunk csrf in the ssg kvstore client endpoint
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200"  | table  splunk_server status uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`
+
 [ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -425,6 +471,98 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary* |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`

+[ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, when the INGEST\\_EVAL parameter is improperly formatted, it crashes splunkd. This hunting search provides the user, timing and number of times the crashing command was executed.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1499"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, when the INGEST\\_EVAL parameter is improperly formatted, it crashes splunkd. This hunting search provides the user, timing and number of times the crashing command was executed.
+action.escu.how_to_implement = Requires access to audittrail and use of Splunk_Audit.Search_Activity datamodel.
+action.escu.known_false_positives = This is a hunting search it should be focused on affected products, otherwise it is likely to produce false positives.
+action.escu.creation_date = 2023-02-14
+action.escu.modification_date = 2023-02-14
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = An attempt to exploit ingest eval parameter was detected from $user$
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "cve": ["CVE-2023-22941"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1499"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, when the INGEST\\_EVAL parameter is improperly formatted, it crashes splunkd. This hunting search provides the user, timing and number of times the crashing command was executed.
+action.notable.param.rule_title = Splunk Improperly Formatted Parameter Crashes splunkd
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*" AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`
+
+[ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0. This search provides information on what user may have potentially added a malicious payload and what users were exposed to it.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0. This search provides information on what user may have potentially added a malicious payload and what users were exposed to it.
+action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index
+action.escu.known_false_positives = This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search.
+action.escu.creation_date = 2023-02-14
+action.escu.modification_date = 2023-02-14
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = A potential XSS attempt has been detected from $user$
+action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "cve": ["CVE-2023-22932"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0. This search provides information on what user may have potentially added a malicious payload and what users were exposed to it.
+action.notable.param.rule_title = Persistent XSS in RapidDiag through User Interface Views
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/* action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`
+
 [ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -665,6 +803,46 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd_webx` user=admin status=200 uri=*/lists/entities/x/ui/views* uri_query!=null | stats count earliest(_time) as event_time values(status) as status values(clientip) as clientip by index, sourcetype, _time, host, user, uri | `splunk_reflected_xss_in_the_templates_lists_radio_filter`

+[ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In February 2023, Splunk disclosed several vulnerabilities affecting Splunk Enterprise commands deemed risky. The following hunting search includes the following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10), pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below 8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more information please review Splunk Vulnerabilities Disclosure, February 2023. Link can be found in reference.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = In February 2023, Splunk disclosed several vulnerabilities affecting Splunk Enterprise commands deemed risky. The following hunting search includes the following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10), pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below 8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more information please review Splunk Vulnerabilities Disclosure, February 2023. Link can be found in reference.
+action.escu.how_to_implement = Requires implementation of Splunk_Audit.Search_Activity datamodel.
+action.escu.known_false_positives = This search encompasses many commands.
+action.escu.creation_date = 2023-02-14
+action.escu.modification_date = 2023-02-14
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Use of risky splunk command $splunk_risky_command$ detected by $user$
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "splunk_risky_command", "threat_object_type": "other"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "cve": ["CVE-2023-22931", "CVE-2023-22934", "CVE-2023-22935", "CVE-2023-22936", "CVE-2023-22939", "CVE-2023-22940"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "splunk_risky_command", "role": ["Other"], "type": "Other"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command as search output splunk_risky_command description vulnerable_versions CVE other_metadata | where splunk_risky_command != "false" | `splunk_risky_command_abuse_disclosed_february_2023_filter`
+
 [ESCU - Splunk Stored XSS via Data Model objectName field - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -705,6 +883,52 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd_webx` uri=/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model* uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`

+[ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table uploads let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now only be one of .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gz. This search provides user activity focus on uploads which aims to help hunt for malicious file uploads.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table uploads let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now only be one of .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gz. This search provides user activity focus on uploads which aims to help hunt for malicious file uploads.
+action.escu.how_to_implement = Requires access to internal splunkd_access.
+action.escu.known_false_positives = This is a hunting search, the search provides information on upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary after executing search. This search will produce false positives as payload cannot be directly discerned.
+action.escu.creation_date = 2023-02-14
+action.escu.modification_date = 2023-02-14
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Potential lookup template injection attempt from $user$ on lookup table at path $uri_path$
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "uri_path", "threat_object_type": "other"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "cve": ["CVE-2023-22937"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "uri_path", "role": ["Other"], "type": "Other"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table uploads let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now only be one of .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gz. This search provides user activity focus on uploads which aims to help hunt for malicious file uploads.
+action.notable.param.rule_title = Splunk unnecessary file extensions allowed by lookup table uploads
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkda` method IN ("POST", "DELETE") uri_path=/servicesNS/*/ui/views/* | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method=="DELETE" , "Deleted" ) | rex field=uri_path "(?<user_and_app>.*?)\/ui\/views/(?<dashboard_encoded>.*)" | eval dashboard = urldecode( dashboard_encoded ) | table _time, uri_path, user, dashboard, activity, uri_path | `splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter`
+
 [ESCU - Splunk User Enumeration Attempt - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -791,6 +1015,46 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd_webx` method=POST  uri=/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`

+[ESCU - Splunk XSS via View - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled. This hunting search shows users action, application and role used for creating views related to this vulnerability.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled. This hunting search shows users action, application and role used for creating views related to this vulnerability.
+action.escu.how_to_implement = This data is collected by default in Splunk.  Upon first enabling this rule, a number of errors may be observed. Those that are due to improperly formatted, but non-nefarious, XML views should be be remedied in the corresponding view. Please take care investigating potential XSS as accessing an affected page could retrigger the exploit.
+action.escu.known_false_positives = The error detected above can be generated for a wide variety of improperly formatted XML views.  There will be false positives as the search cannot extract the malicious payload and the view should be manually investigated.
+action.escu.creation_date = 2023-02-07
+action.escu.modification_date = 2023-02-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk XSS via View - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Potential stored XSS attempt via $fileName$
+action.risk.param._risk = [{"threat_object_field": "fileName", "threat_object_type": "url"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk XSS via View - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "cve": ["CVE-2023-22933"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "observable": [{"name": "fileName", "role": ["Target"], "type": "URL"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = index = _internal sourcetype IN ("splunk_web_service", "splunk_python") message="*loadParams*" | `security_content_ctime(_time)` |  table _time message fileName | `splunk_xss_via_view_filter`
+
 [ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -45360,6 +45624,46 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd_ui` uri_path=*/data/ui/views/* OR uri_path=*saved/searches/* | dedup uri_path | eval URL=urldecode("uri_path")| rex field=URL "\/saved\/searches\/(?<NAME>[^\/]*)" | rex field=URL "\/data\/ui\/views\/(?<NAME1>[^\/]*)" | eval NAME=NAME."( Saved Search )",NAME1=NAME1."( Dashboard )" | eval NAME=coalesce(NAME,NAME1) | eval STATUS=case(match(status,"2\d+"),"SUCCESS",match(status,"3\d+"),"REDIRECTION",match(status,"4\d+") OR match(status,"5\d+"),"ERROR") | stats list(NAME) as DASHBOARD_TITLE,list(method) as HTTP_METHOD,list(status) as Status_Code,list(STATUS) as STATUS by user | rename user as User | `splunk_code_injection_via_custom_dashboard_leading_to_rce_filter`

+[ESCU - Splunk list all nonstandard admin accounts - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search will enumerate all Splunk Accounts with administrative rights on this instance.  It deliberately ignores the default admin account since this is assumed to be present.  This search may help in a detection the Cross-Site Scripting Attack listed: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search will enumerate all Splunk Accounts with administrative rights on this instance.  It deliberately ignores the default admin account since this is assumed to be present.  This search may help in a detection the Cross-Site Scripting Attack listed: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled.
+action.escu.how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures.  If there have been admin account, in addition to the standard admin account, intentionally created on this server, then edit the filter macro to exclude them.
+action.escu.known_false_positives = It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above.  If a user is not believed to be legitimate, then further investigation should take place.
+action.escu.creation_date = 2023-02-07
+action.escu.modification_date = 2023-02-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk list all nonstandard admin accounts - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Potential stored XSS attempt from $host$
+action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk list all nonstandard admin accounts - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "cve": ["CVE-2023-22933"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | rest splunk_server=local /services/authentication/users |search capabilities=admin* OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server | `splunk_list_all_nonstandard_admin_accounts_filter`
+
 [ESCU - Splunk XSS in Monitoring Console - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-07T22:09:12 UTC
+# On Date: 2023-02-14T17:42:34 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -361,6 +361,14 @@ default_match = false
 match_type = WILDCARD(service)
 min_matches = 1

+[splunk_risky_command]
+filename = splunk_risky_command.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of Risky Splunk Command that are candidates for abuse
+match_type = WILDCARD(splunk_risky_command)
+min_matches = 1
+
 [suspicious_writes_lookup]
 filename = suspicious_files.csv
 default_match = false
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-02-07T22:09:12 UTC
+# On Date: 2023-02-14T17:42:34 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -0,0 +1,11 @@
+splunk_risky_command,description,vulnerable_versions,CVE,other_metadata
+*createrss*,createrss command overwrites existing RSS feeds without verifying permissions, 8.1.13 8.2.10,CVE-2023-22931
+*pivot?seedSid=*,pivot command allows a search to bypass SPL safeguards for risky commands using a saved job,8.1.13,8.2.10,9.0.4,CVE-2023-22934
+*|makeresults+&search_listener*,search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user,8.1.13 8.2.10 9.0.4,CVE-2023-22936
+*| map search=*| *,map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands,8.1.13 8.2.10 9.0.4,CVE-2023-22939
+*|mcollect%20index*" ,collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*meventcollect*" ,collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*summaryindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*sumindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*stash*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*| sendalert *,display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation,8.1.13 8.2.10 9.0.4,CVE-2023-22935