First version of new detection for testing

detections/application/splunk_rce_via_serialized_session_payload.yml

@@ -0,0 +1,58 @@
+name: Splunk RCE via Serialized Session Payload
+id: d1d8fda6-874a-400f-82cf-dcbb59d8e4db
+version: 1
+date: '2023-10-02'
+author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
+status: production
+type: Hunting
+description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that 
+  they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code. The exploit requires the use 
+  of the 'collect' SPL command which writes a file within the Splunk Enterprise installation.  The attacker can then use this file to 
+  submit a serialized payload that can result in execution of code within the payload. Please refer to the
+  following URL for additional information on these disclosures - https://advisory.splunk.com
+data_source: []
+search: '`audit_searches` | `splunk_rce_via_serialized_session_payload_filter`'
+how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel.
+known_false_positives: There are numerous many uses of the 'makeresults' and 'collect' SPL commands. 
+  Please evaluate the results of this search for potential abuse.
+references:
+- https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  confidence: 50
+  cve:
+  - CVE-2023-40595
+  impact: 50
+  message: Potential abuse of the 'collect' SPL command against $splunk_server$ by detected by $user$
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  - name: splunk_server
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - search
+  - info
+  - user
+  - search_type
+  - count
+  risk_score: 25
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_rce_via_serialized_session_payload_audittrail.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit