Branch was auto-updated.

detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml

@@ -0,0 +1,54 @@
+name: Splunk csrf in the ssg kvstore client endpoint
+id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410
+version: 1
+date: "2023-02-14"
+author: Rod Soto
+type: TTP
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the kvstore_client endpoint allows for updating SSG KV store collections via a GET request. SSG is a Splunk Built app included by default with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled. This hunting search provides information on affected server specific method and post data that may reveal exploitation of this vulnerability.
+search: '`splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200"  | table  splunk_server status uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`'
+how_to_implement: Requires access to internal index.
+known_false_positives: This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22942
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential CSRF exploitation attempt from $host$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: splunk_server
+      type: Hostname
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - splunk_server
+    - status
+    - uri
+    - delete_field_value
+    - method
+    - post_data
+  risk_score: 25
+  security_domain: threat

detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml

@@ -0,0 +1,57 @@
+name: Splunk Improperly Formatted Parameter Crashes splunkd
+id: 08978eca-caff-44c1-84dc-53f17def4e14
+version: 1
+date: "2023-02-14"
+author: Chase Franklin, Rod Soto, Splunk
+type: TTP
+datamodel:
+  - Endpoint
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, when the INGEST\\_EVAL parameter is improperly formatted, it crashes splunkd. This hunting search provides the user, timing and number of times the crashing command was executed.
+search:
+  '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"
+  AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc
+  Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info
+  Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type
+  | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`'
+how_to_implement: Requires access to audittrail and use of Splunk_Audit.Search_Activity datamodel.
+known_false_positives: This is a hunting search it should be focused on affected products, otherwise it is likely to produce false positives.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22941
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 100
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
+  impact: 100
+  kill_chain_phases:
+    - Exploitation
+  message: An attempt to exploit ingest eval parameter was detected from $user$
+  mitre_attack_id:
+    - T1499
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Attacker
+  product:
+    - Splunk Enterprise
+  required_fields:
+    - user
+    - count
+    - info
+  risk_score: 100
+  security_domain: threat

detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml

@@ -0,0 +1,56 @@
+name: Persistent XSS in RapidDiag through User Interface Views
+id: ce6e1268-e01c-4df2-a617-0f034ed49a43
+version: 1
+date: "2023-02-14"
+author: Rod Soto, Splunk
+type: TTP
+datamodel: []
+description: In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0. This search provides information on what user may have potentially added a malicious payload and what users were exposed to it.
+search:
+  "`audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/*
+  action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`"
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index
+known_false_positives: This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22932
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: A potential XSS attempt has been detected from $user$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: User
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - user
+    - action
+    - roles
+    - info
+    - roles
+    - path
+  risk_score: 25
+  security_domain: threat

detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml

@@ -0,0 +1,62 @@
+name: Splunk risky Command Abuse disclosed february 2023
+id: ee69374a-d27e-4136-adac-956a96ff60fd
+version: 1
+date: "2023-02-14"
+author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
+type: Hunting
+datamodel: []
+description: In February 2023, Splunk disclosed several vulnerabilities affecting Splunk Enterprise commands deemed risky. The following hunting search includes the following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10), pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below 8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more information please review Splunk Vulnerabilities Disclosure, February 2023. Link can be found in reference.
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command as search output splunk_risky_command description vulnerable_versions CVE other_metadata | where splunk_risky_command != "false" | `splunk_risky_command_abuse_disclosed_february_2023_filter`'
+how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel.
+known_false_positives: This search encompasses many commands.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22931
+    - CVE-2023-22934
+    - CVE-2023-22935
+    - CVE-2023-22936
+    - CVE-2023-22939
+    - CVE-2023-22940
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Use of risky splunk command $splunk_risky_command$ detected by $user$
+  mitre_attack_id:
+    - T1548
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Attacker
+    - name: splunk_risky_command
+      type: Other
+      role:
+        - Other
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - search
+    - info
+    - user
+    - search_type
+    - count
+  risk_score: 25
+  security_domain: threat

detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml

@@ -0,0 +1,61 @@
+name: Splunk unnecessary file extensions allowed by lookup table uploads
+id: b7d1293f-e78f-415e-b5f6-443df3480082
+version: 1
+date: "2023-02-14"
+author: Rod Soto, Splunk
+type: TTP
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table uploads let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now only be one of .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gz. This search provides user activity focus on uploads which aims to help hunt for malicious file uploads.
+search:
+  '`splunkda` method IN ("POST", "DELETE") uri_path=/servicesNS/*/ui/views/*
+  | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method=="DELETE" , "Deleted" )
+  | rex field=uri_path "(?<user_and_app>.*?)\/ui\/views/(?<dashboard_encoded>.*)"
+  | eval dashboard = urldecode( dashboard_encoded )
+  | table _time, uri_path, user, dashboard, activity, uri_path
+  | `splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter`'
+how_to_implement: Requires access to internal splunkd_access.
+known_false_positives: This is a hunting search, the search provides information on upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary after executing search. This search will produce false positives as payload cannot be directly discerned.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22937
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential lookup template injection attempt from $user$ on lookup table at path $uri_path$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: uri_path
+      type: Other
+      role:
+        - Other
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - user
+    - method
+    - uri_path
+  risk_score: 25
+  security_domain: threat

detections/application/splunk_xss_via_view.yml

@@ -0,0 +1,50 @@
+name: Splunk XSS via View
+id: 9ac2bfea-a234-4a18-9d37-6d747e85c2e4
+version: 1
+date: "2023-02-07"
+author: Rod Soto, Eric McGinnis, Splunk
+type: Hunting
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled. This hunting search shows users action, application and role used for creating views related to this vulnerability.
+search: index = _internal sourcetype IN ("splunk_web_service", "splunk_python") message="*loadParams*" | `security_content_ctime(_time)` |  table _time message fileName | `splunk_xss_via_view_filter`
+how_to_implement: This data is collected by default in Splunk.  Upon first enabling this rule, a number of errors may be observed. Those that are due to improperly formatted, but non-nefarious, XML views should be be remedied in the corresponding view. Please take care investigating potential XSS as accessing an affected page could retrigger the exploit.
+known_false_positives: The error detected above can be generated for a wide variety of improperly formatted XML views.  There will be false positives as the search cannot extract the malicious payload and the view should be manually investigated.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22933
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential stored XSS attempt via $fileName$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: fileName
+      type: URL
+      role:
+        - Target
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - message
+    - fileName
+  risk_score: 25
+  security_domain: endpoint

detections/experimental/application/splunk_list_all_nonstandard_admin_accounts.yml

@@ -0,0 +1,57 @@
+name: Splunk list all nonstandard admin accounts
+id: 401d689c-8596-4c6b-a710-7b6fdca296d3
+version: 1
+date: "2023-02-07"
+author: Rod Soto
+type: Hunting
+datamodel: []
+description: "This search will enumerate all Splunk Accounts with administrative
+  rights on this instance.  It deliberately ignores the default admin account since
+  this is assumed to be present.  This search may help in a detection the Cross-Site
+  Scripting Attack listed: In Splunk Enterprise versions below 8.1.13, 8.2.10, and
+  9.0.4, a View allows for Cross-Site Scripting in an XML View through the
+  'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled."
+search:
+  "| rest splunk_server=local /services/authentication/users |search capabilities=admin*
+  OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server
+  | `splunk_list_all_nonstandard_admin_accounts_filter`"
+how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures.  If there have been admin account, in addition to the standard admin account, intentionally created on this server, then edit the filter macro to exclude them.
+known_false_positives: It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above.  If a user is not believed to be legitimate, then further investigation should take place.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22933
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential stored XSS attempt from $host$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: splunk_server
+      type: Hostname
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - capabilities
+    - splunk_server
+    - title
+  risk_score: 25
+  security_domain: endpoint

lookups/splunk_risky_command.csv

@@ -0,0 +1,11 @@
+splunk_risky_command,description,vulnerable_versions,CVE,other_metadata
+*createrss*,createrss command overwrites existing RSS feeds without verifying permissions, 8.1.13 8.2.10,CVE-2023-22931
+*pivot?seedSid=*,pivot command allows a search to bypass SPL safeguards for risky commands using a saved job,8.1.13,8.2.10,9.0.4,CVE-2023-22934
+*|makeresults+&search_listener*,search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user,8.1.13 8.2.10 9.0.4,CVE-2023-22936
+*| map search=*| *,map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands,8.1.13 8.2.10 9.0.4,CVE-2023-22939
+*|mcollect%20index*" ,collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*meventcollect*" ,collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*summaryindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*sumindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*|"*stash*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
+*| sendalert *,display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation,8.1.13 8.2.10 9.0.4,CVE-2023-22935

lookups/splunk_risky_command.yml

@@ -0,0 +1,7 @@
+description: A list of Risky Splunk Command that are candidates for abuse
+filename: splunk_risky_command.csv
+name: splunk_risky_command
+default_match: 'false'
+match_type: WILDCARD(splunk_risky_command)
+min_matches: 1
+case_sensitive_match: 'false'

tests/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.test.yml

@@ -0,0 +1,13 @@
+name: Splunk csrf in the ssg kvstore client endpoint Unit Test
+tests:
+  - name: Splunk csrf in the ssg kvstore client endpoint
+    file: "application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml"
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.yml
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
+        source: splunkd_access.log
+        sourcetype: splunkd_access
+        custom_index: _internal

tests/application/splunk_improperly_formatted_parameter_crashes_splunkd.test.yml

@@ -0,0 +1,13 @@
+name: Splunk improperly formatted ingest eval parameter crashes splunkd Unit Test
+tests:
+  - name: Splunk improperly formatted ingest eval parameter crashes splunkd
+    file: application/splunk_improperly_formatted_parameter_crashes_splunkd.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
+        source: splunkd_ui_access.log
+        sourcetype: splunkd_ui_access
+        custom_index: _internal

tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml

@@ -0,0 +1,13 @@
+name: Splunk Persistent XSS in RapidDiag through User Interface Views Unit Test
+tests:
+  - name: Splunk Persistent XSS in RapidDiag through User Interface Views
+    file: application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
+        source: audittrail
+        sourcetype: audittrail
+        custom_index: _audit

tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml

@@ -0,0 +1,13 @@
+name: Splunk risky command abuse disclosed february 2023 Unit Test
+tests:
+  - name: Splunk risky command abuse disclosed february 2023
+    file: application/splunk_risky_command_abuse_disclosed_february_2023.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_createrss_command_abuse.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log
+        source: audittrail
+        sourcetype: audittrail
+        custom_index: _audit

tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml

@@ -0,0 +1,13 @@
+name: Splunk unnecesary file extensions allowed by lookup table uploads Unit Test
+tests:
+  - name: Splunk unnecesary file extensions allowed by lookup table uploads
+    file: application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads_data.txt
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
+        custom_index: _internal
+        source: /opt/splunk/var/log/splunk/splunkd_access.log
+        sourcetype: splunkd_access

tests/application/splunk_xss_via_view.test.yml

@@ -0,0 +1,13 @@
+name: Splunk XSS via View
+tests:
+  - name: Splunk Stored XSS via view module tag layoutPanel attribute
+    file: application/splunk_xss_via_view.yml
+    pass_condition: "| stats count | where count > 0"
+    earliest_time: -24h
+    latest_time: now
+    attack_data:
+      - file_name: splunk_xss_via_view.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log
+        source: /opt/splunk/var/log/splunk/web_service.log
+        sourcetype: splunk_web_service
+        custom_index: _internal