Merge branch 'develop' into nterl0k-o365_various_alerts

.github/CONTRIBUTING.md

@@ -0,0 +1,132 @@
+This document is the single source of truth on how to contribute to this codebase. Please feel free to browse the open issues and file new ones. All feedback is welcome!
+
+----
+
+## Topics
+
+* [Prerequisites](#prerequisites)
+    * [Contributor License Agreement](#contributor-license-agreement)
+    * [Code of Conduct](#code-of-conduct)
+    * [Setup Development Environment](#setup-development-environment)
+* [Contribution Workflow](#contribution-workflow)
+    * [Feature Requests and Bug Reports](#feature-requests-and-bug-reports)
+    * [Fixing Issues](#fixing-issues)
+    * [Pull Requests](#pull-requests)
+    * [Code Review](#code-review)
+    * [Documentation](#documentation)
+* [Maintainers](#maintainers)
+
+----
+
+## Prerequisites
+When contributing to this repository, please first discuss the change you wish to make via a GitHub issue, Slack message, email, or via other channels with the owners of this repository.
+
+##### Contributor License Agreement
+At the moment, we can only accept pull requests submitted from either:
+* Splunk employees or
+* Individuals that have signed our contributors' agreement
+
+If you wish to be a contributing member of our community, please see the agreement [for individuals](https://www.splunk.com/goto/individualcontributions) or [for organizations](https://www.splunk.com/goto/contributions).
+
+##### Code of Conduct
+Please make sure to read and observe our [Code of Conduct](https://github.com/splunk/security_content/wiki/Code-of-Conduct). Please follow it in all of your interactions involving the project.
+
+##### Setup Development Environment
+see [Developing Content](https://github.com/splunk/security_content/wiki/Developing-Content)
+
+## Contribution Workflow
+Help is always welcome! For example, documentation can always use improvement. There's always code that can be clarified, functionality that can be extended, and tests to be added to guarantee behavior. If you see something you think should be fixed, don't be afraid to own it.
+
+##### Feature Requests and Bug Reports
+Have ideas on improvements? See something that needs work? While the community encourages everyone to contribute code, it is also appreciated when someone reports an issue. Please report any issues or bugs you find through [GitHub's issue tracker](https://github.com/splunk/security_content/issues).
+
+If you are reporting a bug, please include:
+
+* Your operating system name and version
+* Any details about your local setup that might be helpful in troubleshooting (ex. Python interpreter version, Splunk version, etc.)
+* Detailed steps to reproduce the bug
+
+We'd also like to hear about your propositions and suggestions. Feel free to submit them as issues and:
+
+* Explain in detail how they should work
+* Note that keeping the scope as narrow as possible will make the suggestion easier to implement
+
+##### Fixing Issues
+Look through our [issue tracker](https://github.com/splunk/security_content/issues) to find problems to fix! Feel free to comment and tag corresponding stakeholders or full-time maintainers of this project with any questions or concerns.
+
+##### Pull Requests
+What is a "pull request"? It informs the project's core developers about the changes you want to review and merge. Once you submit a pull request, it enters a stage of code review where you and others can discuss its potential modifications and maybe even add more commits to it later on.
+
+If you want to learn more, please consult this [tutorial on how pull requests work](https://help.github.com/articles/using-pull-requests/) in the [GitHub Help Center](https://help.github.com/).
+
+Here's an overview of how you can make a pull request against this project:
+
+1. Fill out the [Splunk Contribution Agreement](https://www.splunk.com/goto/contributions).
+2. Fork the [security_content GitHub repository](https://github.com/splunk/security_content)
+3. Clone your fork using git and create a branch off of develop
+
+    ```
+    $ git clone git@github.com:YOUR_GITHUB_USERNAME/security_content.git
+    $ cd security_content
+
+    # This project uses 'develop' for all development activity, so create your branch off that
+    $ git checkout -b your-bugfix-branch-name develop
+    ```
+
+4. Make your changes, commit, and push (once your tests have passed)
+
+    ```
+    $ cd security_content
+    $ git commit -m "<insert helpful commit message>"
+    $ git push
+    ```
+
+5. Submit a pull request through the GitHub website, using the changes from your forked codebase.
+6. We utilize [pre-commit hooks](https://pre-commit.com/) to ensure consistent formatting and as an additional method of preventing credentials from ending up in our repo accidentally. We highly suggest you also install `pre-commit` and the hooks for this project.
+
+##### Code Review
+There are two aspects of code review: giving and receiving.
+
+To make it easier for your PR to receive reviews, keep in mind that the reviewers will need you to:
+* Follow the project coding conventions
+* Write good commit messages
+* Break large changes into a logical series of smaller patches which individually make easily understandable changes, and in aggregate solve a broader issue
+
+Reviewers, the people providing the review, are highly encouraged to revisit the [Code of Conduct](https://github.com/splunk/security_content/wiki/Code-of-Conduct) and must go above and beyond to promote a collaborative, respectful community.
+
+When reviewing PRs from others, [The Gentle Art of Patch Review](http://sage.thesharps.us/2014/09/01/the-gentle-art-of-patch-review/) suggests an iterative series of focuses designed to lead new contributors to positive collaboration, such as:
+
+* Is the idea behind the contribution sound?
+* Is the contribution architected correctly?
+* Is the contribution polished?
+
+For this project, we require at least one approval. A build from our continuous integration system must also be successful off of your branch. Please note that any new changes made with your existing pull request during review will automatically unapproved and re-trigger another build/round of tests.
+
+##### Documentation
+We can always use improvements to our documentation! Anyone can contribute to these docs--whether you’re new to the project, you’ve been around a long time, or if you just can’t stand seeing typos.
+
+Here's what's needed?
+
+1. More complementary documentation. Have you something unclear?
+2. More examples or generic templates that others can use.
+3. Blog posts, articles, and such are all very appreciated.
+
+You can also edit documentation files directly in the GitHub web interface, without creating a local copy. This can be convenient for small typos or grammar fixes.
+
+## Maintainers
+
+If you need help, feel free to tag one of the active maintainers of this project in a post or comment. We'll do our best to reach out to you as quickly as we can.
+
+```
+# Active maintainers marked with (*)
+
+(*) Bhavin Patel
+(*) Michael Haag
+(*) Jose Hernandez
+(*) Lou Stella
+(*) Patrick Bareib
+(*) Eric McGinnis
+(*) Rod Soto
+(*) Teoderick Contreras
+(*) Gowtham Rajendran
+```

.github/labeler.yml

@@ -0,0 +1,21 @@
+Detections:
+- changed-files:
+  - any-glob-to-any-file: 
+    - detections/**
+    - dev/**
+
+Stories:
+- changed-files:
+  - any-glob-to-any-file: stories/*
+
+Playbooks:
+- changed-files:
+  - any-glob-to-any-file: playbooks/*
+
+Macros:
+- changed-files:
+  - any-glob-to-any-file: macros/*
+
+Lookups:
+- changed-files:
+  - any-glob-to-any-file: lookups/*

.github/workflows/build.yml

@@ -23,7 +23,7 @@ jobs:
       
       - name: Install Python Dependencies and ContentCTL and Atomic Red Team
         run: |
-          pip install contentctl
+          pip install contentctl==4.1.5
           git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git
       
       - name: Running build with enrichments

.github/workflows/labeler.yml

@@ -0,0 +1,18 @@
+name: "Pull Request Labeler"
+on:
+- pull_request_target
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with: 
+        repository: "splunk/security_content"
+    - uses: actions/labeler@v5
+      with:
+        sync-labels: true
+        configuration-path: '.github/labeler.yml'

.github/workflows/unit-testing.yml

@@ -24,7 +24,7 @@ jobs:
         - name: Install Python Dependencies and ContentCTL
           run: |
             python -m pip install --upgrade pip
-            pip install contentctl
+            pip install contentctl==4.1.5
            
         # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop
         # Make sure we check out the PR, even if it actually lives in a fork

.pre-commit-config.yaml

@@ -1,12 +1,15 @@
 repos:
-- repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v2.1.0  # Use the ref you want to point at
-  hooks:
-    - id: check-executables-have-shebangs
-      exclude: 'package/bin/da_ess_contentupdate/|package/bin/splunklib/|venv/'
-    - id: check-json
-    - id: check-symlinks
-    - id: check-yaml
-    - id: pretty-format-json
-      args: [--autofix]
-    - id: requirements-txt-fixer
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0 # Use the ref you want to point at
+    hooks:
+      - id: check-executables-have-shebangs
+        exclude: "package/bin/da_ess_contentupdate/|package/bin/splunklib/|venv/"
+      - id: check-json
+      - id: check-symlinks
+      - id: check-yaml
+      - id: pretty-format-json
+        args: [--autofix]
+      - id: requirements-txt-fixer
+      - id: detect-aws-credentials
+      - id: detect-private-key
+      - id: forbid-submodules

CODE_OF_CONDUCT.md

@@ -0,0 +1,3 @@
+# Code Of Conduct
+
+The Code of Conduct for this repository can be found online [in our wiki](https://github.com/splunk/security_content/wiki/Code-of-Conduct). 

README.md

@@ -74,7 +74,7 @@ To view an up-to-date detection coverage map for all the content tagged with MIT
 * [data_sources/](data_sources/): Defines the data sources, the necessary TA or App to collect them and the fields provided that can be used by the detections.
 
 # Contribution 🥰
-We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved.
+We welcome feedback and contributions from the community! Please see our [contributing to the project](./.github/CONTRIBUTING.md) for more information on how to get involved.
 
 ## Support 💪
 If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can open a support case on the https://www.splunk.com/ support portal.

app_template/default/app.conf

@@ -8,7 +8,6 @@ build = 16367
 
 [triggers]
 reload.analytic_stories = simple
-reload.usage_searches = simple
 reload.use_case_library = simple
 reload.correlationsearches = simple
 reload.analyticstories = simple

app_template/default/usage_searches.conf

@@ -1,73 +0,0 @@
-[escu-metrics-usage]
-action.email.useNSSubject = 1
-alert.digest_mode = True
-alert.suppress = 0
-alert.track = 0
-auto_summarize.dispatch.earliest_time = -1d@h
-dispatchAs = user
-search = index=_audit sourcetype="audittrail" \
-"ESCU - "\
-`comment("Find all the search names in the audittrail.")`\
-| stats count(search) by search savedsearch_name user\
-| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
-`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\
-| rex field=search "\"(?<savedsearch_name>.*)\""\
-`comment("Extract the name of the search from the search string")`\
-| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
-
-[escu-metrics-search]
-action.email.useNSSubject = 1
-alert.suppress = 0
-alert.track = 0
-auto_summarize.dispatch.earliest_time = -1d@h
-enableSched = 1
-cron_schedule = 0 0 * * *
-dispatch.earliest_time = -4h@h
-dispatch.latest_time = -1h@h
-search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)
-
-[escu-metrics-search-events]
-action.email.useNSSubject = 1
-alert.digest_mode = True
-alert.suppress = 0
-alert.track = 0
-auto_summarize.dispatch.earliest_time = -1d@h
-cron_schedule = 0 0 * * *
-enableSched = 1
-dispatch.earliest_time = -4h@h
-dispatch.latest_time = -1h@h
-search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")
-
-[escu-metrics-search-longest-runtime]
-action.email.useNSSubject = 1
-alert.digest_mode = True
-alert.suppress = 0
-alert.track = 0
-auto_summarize.dispatch.earliest_time = -1d@h
-enableSched = 1
-cron_schedule = 0 0 * * *
-disabled = 1
-dispatch.earliest_time = -4h@h
-dispatch.latest_time = -1h@h
-search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id
-
-[escu-metrics-usage-search]
-action.email.useNSSubject = 1
-alert.digest_mode = True
-alert.suppress = 0
-alert.track = 0
-auto_summarize.dispatch.earliest_time = -1d@h
-cron_schedule = 0 0 * * *
-dispatch.earliest_time = -4h@h
-dispatch.latest_time = -1h@h
-enableSched = 1
-dispatchAs = user
-search = index=_audit sourcetype="audittrail" \
-"ESCU - "\
-`comment("Find all the search names in the audittrail. Ignore the last few minutes so we can exclude this search's text from the result.")`\
-| stats count(search) by search savedsearch_name user\
-| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
-`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\
-| rex field=search "\"(?<savedsearch_name>.*)\""\
-`comment("Extract the name of the search from the search string")`\
-| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*

baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml

@@ -1,85 +0,0 @@
-name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline
-id: 273df2f7-643a-451a-8d4d-637e39eadc87
-version: 1
-date: '2022-05-27'
-author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
-type: Baseline
-datamodel:
-- Splunk_Audit
-description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
-This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting.
-The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior.
-The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here:
-https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps
-unless the same account of training this model will be used to perform inference using this model for anomaly
-detection.'
-search: '| tstats sum(Search_Activity.total_run_time) as run_time, count 
-  FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") 
-  AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) 
-  AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", 
-  "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) 
-  AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) 
-  BY _time, Search_Activity.user span=1h 
-  | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true 
-  by Search_Activity.user into "risky_command_abuse" '
-how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky 
-  SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/
-  and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might 
-  take significant computing resources. It might require dedicated search head. The underlined machine learning 
-  algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as 
-  max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction 
-  parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply
-  Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points 
-  to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better
-  suit users' violation policy and their usage environment.
-known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density 
-  function model, false positives can occur, incorrectly labeling a long running search as potentially risky. 
-references:
-- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Web Server
-  cis20:
-  - CIS 3
-  - CIS 6
-  confidence: 40
-  cve:
-  - CVE-2022-32154
-  context:
-  - Source: Endpoint
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
-  impact: 50
-  kill_chain_phases:
-  - Actions on Objectives
-  message: ML model "risky_command_abuse" training is completed.
-  mitre_attack_id:
-  - T1059
-  nist:
-  - DE.AE
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Search_Activity.search
-  - Search_Activity.total_run_time 
-  - Search_Activity.user 
-  - Search_Activity.search_type
-  risk_score: 20
-  security_domain: audit
-  detections: 
-  - Splunk Command and Scripting Interpreter Risky SPL MLTK
-deployment:
-  scheduling:
-    cron_schedule: 55 * * * *
-    earliest_time: -70m@m
-    latest_time: -10m@m
-    schedule_window: auto

detections/application/detect_risky_spl_using_pretrained_ml_model.yml

@@ -1,69 +0,0 @@
-name: Detect Risky SPL using Pretrained ML Model
-id: b4aefb5f-1037-410d-a149-1e091288ba33
-version: 2
-date: '2024-05-26'
-author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk
-status: experimental
-type: Anomaly
-description: The following analytic identifies potentially risky SPL commands executed
-  by users. It leverages a pretrained machine learning text classifier that analyzes
-  command text, user, and search type to assign a risk score between 0 and 1. This
-  detection is significant as it helps identify suspicious or unauthorized search
-  activities that could indicate malicious intent or misuse of the Splunk environment.
-  If confirmed malicious, such activity could lead to unauthorized data access, data
-  exfiltration, or further exploitation of the system.
-data_source: []
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc
-  Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user
-  Search_Activity.search_type | eval spl_text = ''Search_Activity.search''. " " .''Search_Activity.user''.
-  " " .''Search_Activity.search_type''| dedup spl_text | apply risky_spl_pre_trained_model
-  | where risk_score > 0.5 | `drop_dm_object_name(Search_Activity)` | table search,
-  user, search_type, risk_score | `detect_risky_spl_using_pretrained_ml_model_filter`'
-how_to_implement: This detection depends on the MLTK app which can be found here -
-  https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can
-  be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need
-  to be ingesting logs which include Search_Activity.search, Search_Activity.user,
-  Search_Activity.search_type from your endpoints. The risk score threshold should
-  be adjusted based on the environment. The detection uses a custom MLTK model hence
-  we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb.
-known_false_positives: False positives may be present if suspicious behavior is observed,
-  as determined by frequent usage of risky keywords.
-references:
-- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Web Server
-  confidence: 40
-  cve:
-  - CVE-2022-32154
-  impact: 50
-  message: A potentially risky Splunk command has been run by $user$, kindly review.
-  mitre_attack_id:
-  - T1059
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Search_Activity.search
-  - Search_Activity.user
-  - Search_Activity.search_type
-  risk_score: 20
-  security_domain: audit
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
-    source: audittrail
-    sourcetype: audittrail
-    update_timestamp: true
-    custom_index: _audit

detections/application/path_traversal_spl_injection.yml

@@ -1,68 +0,0 @@
-name: Path traversal SPL injection
-id: dfe55688-82ed-4d24-a21b-ed8f0e0fda99
-version: 3
-date: '2024-05-26'
-author: Rod Soto, Splunk
-status: production
-type: TTP
-description: The following analytic identifies attempts at path traversal in search
-  parameters, which can lead to SPL injection. It detects this activity by searching
-  for specific patterns in the `_internal` index that indicate path traversal attempts
-  (e.g., "../../../../"). This activity is significant for a SOC because it can allow
-  an attacker to manipulate the application to load data from incorrect endpoints,
-  potentially running arbitrary SPL queries. If confirmed malicious, this could lead
-  to unauthorized data access, code execution, or further exploitation of the Splunk
-  environment.
-data_source:
-- Splunk
-search: ' `path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/"  |
-  stats count by host status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _internal index. This search will
-  provide search UI requests with path traversal parameter ("../../../../../../../../../")
-  which shows exploitation attempts. This detection is meant for on premise environments,
-  and if executed on internet facing servers without a WAF may produce a lot of results.
-  This detection will not work against obfuscated path traversal requests.
-known_false_positives: This search may find additional path traversal exploitation
-  attempts.
-references:
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 80
-  cve:
-  - CVE-2022-26889
-  impact: 50
-  message: Path traversal exploitation attempt from $clientip$
-  mitre_attack_id:
-  - T1083
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  required_fields:
-  - status
-  - clientip
-  - method
-  - uri_path
-  - uri_query
-  risk_score: 40
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt
-    source: splunkd_ui_access.log
-    sourcetype: splunkd_ui_access
-    custom_index: _internal

detections/application/persistent_xss_in_rapiddiag_through_user_interface_views.yml

@@ -1,68 +0,0 @@
-name: Persistent XSS in RapidDiag through User Interface Views
-id: ce6e1268-e01c-4df2-a617-0f034ed49a43
-version: 2
-date: "2024-05-24"
-author: Rod Soto, Splunk
-type: TTP
-status: production
-data_source:
-- Splunk
-description: The following analytic identifies potential persistent Cross-Site Scripting
-  (XSS) attacks in Splunk Enterprise 9.0 versions before 9.0.4 through user interface
-  views. It leverages audit logs from the `audit_searches` data source to detect actions
-  involving Base64-encoded images in error messages. This activity is significant
-  because it can allow attackers to inject malicious scripts that execute in the context
-  of other users, leading to unauthorized actions or data exposure. If confirmed malicious,
-  this could result in persistent control over the affected Splunk instance, compromising
-  its integrity and confidentiality.
-search: "`audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/*
-  action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`"
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _internal index
-known_false_positives: This is a hunting search, it will not deobfuscate base64 payload,
-  it provides however it will provide what user added the view artifact and what user
-  opened it. It will require further investigation based on the information presented
-  by this hunting search.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  cve:
-  - CVE-2023-22932
-  confidence: 50
-  context:
-  - Source:Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
-  impact: 50
-  message: A potential XSS attempt has been detected from $user$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - user
-  - action
-  - roles
-  - info
-  - roles
-  - path
-  risk_score: 25
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit

detections/application/splunk_absolute_path_traversal_using_runshellscript.yml

@@ -1,72 +0,0 @@
-name: Splunk Absolute Path Traversal Using runshellscript
-id: 356bd3fe-f59b-4f64-baa1-51495411b7ad
-version: 2
-date: '2024-05-17'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic detects the exploitation of an absolute path traversal
-  vulnerability in Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1,
-  where an attacker can execute arbitrary code located on a separate disk. It leverages
-  logs from the `splunk_python` macro, specifically looking for the `runshellscript`
-  command with a specific argument count and path pattern. This activity is significant
-  as it indicates a potential exploitation attempt that could lead to unauthorized
-  code execution. If confirmed malicious, this could allow an attacker to gain control
-  over the Splunk instance, leading to data breaches or further system compromise.
-search: >-
-  `splunk_python` *runshellscript*  | eval log_split=split(_raw, "runshellscript:
-  ")
-  | eval array_raw = mvindex(log_split,1)
-  | eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","")
-  | eval array_indices=split(data_cleaned,",")
-  | eval runshellscript_args_count=mvcount(array_indices)
-  | where runshellscript_args_count = 10
-  | eval interpreter=mvindex(array_indices,0)
-  | eval targetScript=mvindex(array_indices,1)
-  | eval targetScript != "*C:*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter
-  targetScript
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `splunk_absolute_path_traversal_using_runshellscript_filter`
-how_to_implement: Must have access to internal indexes. Only applies to Splunk on
-  Windows versions.
-known_false_positives: The command runshellscript can be used for benign purposes.
-  Analyst will have to review the searches and determined maliciousness specially
-  by looking at targeted script.
-references:
-- https://advisory.splunk.com/advisories/SVD-2023-0806
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 70
-  impact: 50
-  message: Possible attack against splunk_server $splunk_server$ through abuse of
-    the runshellscript command
-  mitre_attack_id:
-  - T1083
-  cve:
-  - CVE-2023-40597
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 35
-  required_fields:
-  - search
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_absolute_path_traversal_using_runshellscript_splunk_python.log
-    source: python.log
-    sourcetype: splunk_python
-    custom_index: _internal

detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml

@@ -1,53 +0,0 @@
-name: Splunk Account Discovery Drilldown Dashboard Disclosure
-id: f844c3f6-fd99-43a2-ba24-93e35fe84be6
-version: 2
-date: '2024-05-15'
-author: Marissa Bower, Rod Soto, Splunk
-status: experimental
-type: TTP
-description: The following analytic identifies the presence of environment variables
-  in Splunk dashboard drilldown URLs. It uses the REST API to query dashboards for
-  specific patterns in the XML data. This activity is significant because it can expose
-  sensitive tokens from privileged users if an attacker shares a malicious dashboard.
-  If confirmed malicious, this could allow an attacker to detokenize variables and
-  potentially gain unauthorized access to sensitive information or escalate privileges
-  within the Splunk environment.
-data_source: []
-search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*"
-  eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing
-  AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions
-  App "Dashboard XML" | `splunk_account_discovery_drilldown_dashboard_disclosure_filter`'
-how_to_implement: This search uses REST function to query for dashboards with environment
-  variables present in URL options.
-known_false_positives: This search may reveal non malicious URLs with environment
-  variables used in organizations.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 80
-  cve:
-  - CVE-2022-37438
-  impact: 50
-  message: Potential exposure of environment variables from url embedded in dashboard
-  mitre_attack_id:
-  - T1087
-  observable:
-  - name: author
-    type: User
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - eai:data
-  - splunk_server
-  - author
-  - eai:acl.sharing
-  - eai:appName
-  risk_score: 40
-  security_domain: threat

detections/application/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml

@@ -1,62 +0,0 @@
-name: Splunk App for Lookup File Editing RCE via User XSLT
-id: a053e6a6-2146-483a-9798-2d43652f3299
-version: 2
-date: '2024-05-16'
-author: Rod Soto, Splunk
-status: experimental
-type: Hunting
-data_source: []
-description: The following analytic identifies the creation of lookup files in Splunk,
-  which could indicate an attempt to exploit remote code execution via user-supplied
-  XSLT. It leverages REST API queries to monitor the creation of these lookups, focusing
-  on fields such as title, author, and access control lists. This activity is significant
-  because it targets a known vulnerability in Splunk versions 9.1.x, potentially allowing
-  attackers to execute arbitrary code. If confirmed malicious, this could lead to
-  unauthorized code execution, compromising the integrity and security of the Splunk
-  environment.
-search: '| rest splunk_server=local /services/data/lookup-table-files/ | fields title
-  author disabled eai:acl.app eai:acl.owner eai:acl.sharing eai:appName eai:data |
-  `splunk_app_for_lookup_file_editing_rce_via_user_xslt_filter`'
-how_to_implement: Because there is no way to detect the payload, this search only
-  provides the ability to monitor the creation of lookups which are the base of this
-  exploit. An operator must then investigate suspicious lookups. This search requires
-  ability to perform REST queries. Note that if the Splunk App for Lookup File Editing
-  is not, or was not, installed in the Splunk environment then it is not necessary
-  to run the search as the enviornment was not vulnerable.
-known_false_positives: This search will provide information for investigation and
-  hunting of lookup creation via user-supplied XSLT which may be indications of possible
-  exploitation. There will be false positives as it is not possible to detect the
-  payload executed via this exploit.
-references:
-- https://advisory.splunk.com/advisories/SVD-2023-1104
-cve:
-- CVE-2023-46214
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 2
-  impact: 50
-  message: Please review $eai:acl.app$ for possible malicious lookups
-  mitre_attack_id:
-  - T1210
-  observable:
-  - name: eai:acl.app
-    type: Other
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 1
-  required_fields:
-  - title
-  - author
-  - disabled
-  - ea:acl.app
-  - eai:acl.owner
-  - eai:acl.sharing
-  - eai:appName
-  - eai:data
-  security_domain: endpoint

detections/application/splunk_authentication_token_exposure_in_debug_log.yml

@@ -1,62 +0,0 @@
-name: Splunk Authentication Token Exposure in Debug Log
-id: 9a67e749-d291-40dd-8376-d422e7ecf8b5
-version: 2
-date: '2024-05-25'
-author: Rod Soto, Chase Franklin
-type: TTP
-status: production
-data_source: []
-description: The following analytic identifies exposed authentication tokens in debug
-  logs within Splunk Enterprise. It leverages logs from the `splunkd` component with
-  a DEBUG log level, specifically searching for event messages that validate tokens.
-  This activity is significant because exposed tokens can be exploited by attackers
-  to gain unauthorized access to the Splunk environment. If confirmed malicious, this
-  exposure could lead to unauthorized data access, privilege escalation, and potential
-  compromise of the entire Splunk infrastructure. Monitoring and addressing this vulnerability
-  is crucial for maintaining the security and integrity of the Splunk deployment.
-search: '`splunkd` component=JsonWebToken log_level=DEBUG eventtype="splunkd-log"
-  event_message="Validating token:*" | rex "Validating token: (?<token>.*)\.$" | search
-  token!=None | stats count min(_time) as firstTime max(_time) as lastTime values(log_level)
-  as log_level values(event_message) as event_message by index, sourcetype, host,
-  token | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `splunk_authentication_token_exposure_in_debug_log_filter`'
-how_to_implement: Requires access to internal Splunk indexes.
-known_false_positives: Only applies to affected versions of Splunk Enterprise below
-  9.2.1, 9.1.4, and 9.0.9
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0301
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  confidence: 100
-  cve:
-  - CVE-2024-29945
-  impact: 50
-  message: Possible JsonWebToken exposure, please investigate affected $host$
-  mitre_attack_id:
-  - T1654
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Cloud
-  required_fields:
-  - component
-  - log_level
-  - eventtype
-  - event_message
-  - host
-  risk_score: 50
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log
-    source: /opt/splunk/var/log/splunk/splunkd.log
-    sourcetype: splunkd
-    custom_index: _internal

detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml

@@ -1,68 +0,0 @@
-name: Splunk Code Injection via custom dashboard leading to RCE
-id: b06b41d7-9570-4985-8137-0784f582a1b3
-version: 2
-date: '2024-05-24'
-author: Rod Soto
-status: experimental
-type: Hunting
-description: The following analytic identifies attempts to exploit a vulnerability
-  in Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, where an authenticated
-  user can execute arbitrary code via the dashboard PDF generation component. It detects
-  this activity by analyzing events in the _internal index with the file=export parameter.
-  This behavior is significant because it indicates a potential code injection attack,
-  which could lead to remote code execution (RCE). If confirmed malicious, an attacker
-  could gain unauthorized access, execute arbitrary commands, and potentially compromise
-  the entire Splunk environment.
-data_source: []
-search: '`splunkd_ui` uri_path=*/data/ui/views/* OR uri_path=*saved/searches/* | dedup
-  uri_path | eval URL=urldecode("uri_path")| rex field=URL "\/saved\/searches\/(?<NAME>[^\/]*)"
-  | rex field=URL "\/data\/ui\/views\/(?<NAME1>[^\/]*)" | eval NAME=NAME."( Saved
-  Search )",NAME1=NAME1."( Dashboard )" | eval NAME=coalesce(NAME,NAME1) | eval STATUS=case(match(status,"2\d+"),"SUCCESS",match(status,"3\d+"),"REDIRECTION",match(status,"4\d+")
-  OR match(status,"5\d+"),"ERROR") | stats list(NAME) as DASHBOARD_TITLE,list(method)
-  as HTTP_METHOD,list(status) as Status_Code,list(STATUS) as STATUS by user | rename
-  user as User | `splunk_code_injection_via_custom_dashboard_leading_to_rce_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _internal index.
-known_false_positives: Not all exports and downloads are malicious, special attention
-  must be put as well on /en-US/splunkd/__raw/services/pdfgen/render in the context
-  of this search.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2022-43571
-  impact: 50
-  message: Potential exploitation of Code Injection via Dashboard PDF generation.
-  mitre_attack_id:
-  - T1210
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - user
-  - clientip
-  - uri
-  - uri_path
-  - method
-  - status
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_code_injection_via_custom_dashboard_leading_to_rce.txt
-    source: /opt/splunk/var/log/splunk/splunkd_ui_access.log
-    sourcetype: splunkd_ui_access
-    custom_index: _internal
-    update_timestamp: true

detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml

@@ -1,71 +0,0 @@
-name: Splunk Command and Scripting Interpreter Delete Usage
-id: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04
-version: 2
-date: '2024-05-21'
-author: Michael Haag, Splunk
-status: production
-type: Anomaly
-description: The following analytic detects the use of the 'delete' command in Splunk,
-  which can be used to remove queried data. This detection leverages the Splunk Audit
-  data model, specifically monitoring ad-hoc searches containing the 'delete' command
-  by non-system users. This activity is significant because the 'delete' command is
-  rarely used and can indicate potential data tampering or unauthorized data removal.
-  If confirmed malicious, this activity could lead to the loss of critical log data,
-  hindering incident investigations and compromising the integrity of the monitoring
-  environment.
-data_source:
-- Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search
-  IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
-  by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user
-  Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`'
-how_to_implement: To successfully implement this search acceleration is recommended
-  against the Search_Activity datamodel that runs against the splunk _audit index.
-  In addition, this analytic requires the Common Information Model App which includes
-  the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/.
-known_false_positives: False positives may be present if this command is used as a
-  common practice. Filter as needed.
-references:
-- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Web Server
-  confidence: 30
-  cve:
-  - CVE-2022-32154
-  impact: 90
-  message: $user$ executed the 'delete' command, if this is unexpected it should be
-    reviewed.
-  mitre_attack_id:
-  - T1059
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Search_Activity.search
-  - Search_Activity.info
-  - Search_Activity.total_run_time
-  - Search_Activity.user
-  - Search_Activity.savedsearch_name
-  - Search_Activity.search_type
-  risk_score: 27
-  security_domain: audit
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
-    source: audittrail
-    sourcetype: audittrail
-    update_timestamp: true
-    custom_index: _audit

detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml

@@ -1,81 +0,0 @@
-name: Splunk Command and Scripting Interpreter Risky Commands
-id: 1cf58ae1-9177-40b8-a26c-8966040f11ae
-version: 2
-date: '2024-05-19'
-author: Michael Haag, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies the execution of risky commands within
-  the Splunk platform, such as `runshellscript`, `delete`, and `sendemail`. It leverages
-  the Search_Activity data model to detect ad hoc searches containing these commands,
-  excluding those run by the splunk-system-user. This activity is significant because
-  it may indicate attempts at data exfiltration, deletion, or other unauthorized actions
-  by a malicious user. If confirmed malicious, this could lead to data loss, unauthorized
-  data transfer, or system compromise, severely impacting the organization's security
-  posture.
-data_source:
-- Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search
-  IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv
-  *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail
-  *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
-  by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user
-  Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`'
-how_to_implement: To successfully implement this search acceleration is recommended
-  against the Search_Activity datamodel that runs against the splunk _audit index.  In
-  addition, this analytic requires the Common Information Model App which includes
-  the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR
-  customers can find a SOAR workbook that walks an analyst through the process of
-  running these hunting searches in the references list of this detection. In order
-  to use this workbook, a user will need to run a curl command to post the file to
-  their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template
-  -d @splunk_psa_0622.json". A user should then create an empty container or case,
-  attach the workbook, and begin working through the tasks.
-known_false_positives: False positives will be present until properly filtered by
-  Username and search name.
-references:
-- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
-- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
-- https://advisory.splunk.com/advisories/SVD-2024-0302
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Web Server
-  confidence: 40
-  cve:
-  - CVE-2022-32154
-  - CVE-2024-29946
-  impact: 50
-  message: A risky Splunk command has ran by $user$ and should be reviewed.
-  mitre_attack_id:
-  - T1059
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Search_Activity.search
-  - Search_Activity.info
-  - Search_Activity.total_run_time
-  - Search_Activity.user
-  - Search_Activity.savedsearch_name
-  - Search_Activity.search_type
-  risk_score: 20
-  security_domain: audit
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
-    source: audittrail
-    sourcetype: audittrail
-    update_timestamp: true
-    custom_index: _audit

detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml

@@ -1,74 +0,0 @@
-name: Splunk Command and Scripting Interpreter Risky SPL MLTK
-id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca
-version: 2
-date: '2024-05-15'
-author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
-status: production
-type: Anomaly
-description: The following analytic identifies the execution of risky SPL commands
-  with abnormally long run times by leveraging a machine learning model named "risky_command_abuse."
-  It uses the Splunk Audit data model to compare current search activities against
-  a baseline of the past seven days. This activity is significant for a SOC as it
-  can indicate potential misuse or abuse of powerful SPL commands, which could lead
-  to unauthorized data access or system manipulation. If confirmed malicious, this
-  activity could allow an attacker to execute arbitrary scripts, delete data, or exfiltrate
-  sensitive information.
-data_source:
-- Splunk
-search: '| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search)
-  as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="")
-  AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search
-  IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv
-  *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail
-  *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user)
-  BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time,
-  Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time)
-  as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`'
-how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/
-  and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/.
-  Baseline model needs to be built using "Splunk Command and Scripting Interpreter
-  Risky SPL MLTK Baseline" before this search can run. Please note that the current
-  search only finds matches exactly one space between separator bar and risky commands.
-known_false_positives: If the run time of a search exceeds the boundaries of outlier
-  defined by the fitted density function model, false positives can occur, incorrectly
-  labeling a long running search as potentially risky.
-references:
-- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Web Server
-  confidence: 40
-  cve:
-  - CVE-2022-32154
-  impact: 50
-  message: Abnormally long run time for risk SPL command seen by user $(Search_Activity.user).
-  mitre_attack_id:
-  - T1059
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Search_Activity.search
-  - Search_Activity.total_run_time
-  - Search_Activity.user
-  - Search_Activity.search_type
-  risk_score: 20
-  security_domain: audit
-  manual_test: This search has a baseline and timestamps hard coded into the search.
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
-    source: audittrail
-    sourcetype: audittrail
-    update_timestamp: true
-    custom_index: _audit

detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml

@@ -1,64 +0,0 @@
-name: Splunk CSRF in the SSG kvstore Client Endpoint
-id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410
-version: 3
-date: '2024-07-01'
-author: Rod Soto
-status: production
-type: TTP
-description: The following analytic identifies attempts to exploit a cross-site request
-  forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client
-  endpoint. It detects GET requests to the vulnerable endpoint using internal index
-  data, focusing on specific URI paths and HTTP methods. This activity is significant
-  because it can allow unauthorized updates to SSG KV store collections, potentially
-  leading to data manipulation or unauthorized access. If confirmed malicious, this
-  could enable attackers to alter critical configurations or exfiltrate sensitive
-  information, compromising the integrity and security of the Splunk environment.
-data_source:
-- Splunk
-search: '`splunkda` uri_path="/*/splunkd/__raw/services/ssg/kvstore_client" method="GET"
-  delete_field_value="spacebridge_server" status="200"  | table splunk_server status
-  uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`'
-how_to_implement: Requires access to internal index.
-known_false_positives: This hunting search only applies to the affected versions and
-  setup mentioned in the description of this search, it does not extract payload so
-  it requires manual investigation after executing search. This search will produce
-  false positives.
-references:
-- https://advisory.splunk.com/advisories/SVD-2023-0212
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2023-22942
-  impact: 50
-  message: Potential CSRF exploitation attempt from $splunk_server$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - splunk_server
-  - status
-  - uri
-  - delete_field_value
-  - method
-  - post_data
-  risk_score: 25
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
-    source: splunkd_access.log
-    sourcetype: splunkd_access
-    custom_index: _internal

detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml

@@ -1,70 +0,0 @@
-name: Splunk Data exfiltration from Analytics Workspace using sid query
-id: b6d77c6c-f011-4b03-8650-8f10edb7c4a8
-version: 2
-date: '2024-05-25'
-author: Rod Soto, Eric McGinnis
-status: production
-type: Hunting
-description: The following analytic identifies attempts to exfiltrate data by executing
-  a prepositioned malicious search ID in Splunk's Analytic Workspace. It leverages
-  the `audit_searches` data source to detect suspicious `mstats` commands indicative
-  of injection attempts. This activity is significant as it may indicate a phishing-based
-  attack where an attacker compels a victim to initiate a malicious request, potentially
-  leading to unauthorized data access. If confirmed malicious, this could result in
-  significant data exfiltration, compromising sensitive information and impacting
-  the organization's security posture.
-data_source:
-- Splunk
-search: '`audit_searches` info=granted search NOT ("audit_searches") search NOT ("security_content_summariesonly")
-  AND ((search="*mstats*[*]*" AND provenance="N/A") OR (search="*mstats*\\\"*[*]*\\\"*"))|
-  eval warning=if(match(search,"\\\\\""), "POTENTIAL INJECTION STAGING", "POTENTIAL
-  INJECTION EXECUTION") | table search, user, warning, timestamp | `splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter`'
-how_to_implement: The vulnerability affects only instances with Splunk Web Enabled.  After
-  running this search, please run "Splunk Command and Scripting Interpreter Risky
-  SPL MLTK" to gain more insight into potentially risky commands which could lead
-  to data exfiltration.
-known_false_positives: This search may produce false positives.  This detection does
-  not require you to ingest any new data. The detection does require the ability to
-  search the _audit index. Special attention must be paid to "/en-US/app/search/analytics_workspace?sid=[sid]"
-  which is where the malicious code will be inserted to trigger attack at victim.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2022-43566
-  impact: 50
-  message: Potential data exfiltration attack using SID query by $user$
-  mitre_attack_id:
-  - T1567
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - action
-  - info
-  - user
-  - search_id
-  - metadata
-  - user
-  - _time
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1567/splunk/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.txt
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit
-    update_timestamp: true

detections/application/splunk_digital_certificates_infrastructure_version.yml

@@ -1,70 +0,0 @@
-name: Splunk Digital Certificates Infrastructure Version
-id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7
-version: 2
-date: '2024-05-27'
-author: Lou Stella, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies improper TLS validation configuration
-  on Splunk search heads and peers post version 9. It leverages REST API calls to
-  retrieve server information and SSL configuration settings, checking fields like
-  `sslVerifyServerCert` and `sslVerifyServerName`. This activity is significant for
-  a SOC as improper TLS settings can expose the infrastructure to man-in-the-middle
-  attacks and data breaches. If confirmed malicious, attackers could intercept or
-  manipulate data, compromising the integrity and confidentiality of communications
-  within the Splunk environment.
-data_source:
-- Splunk
-search: '| rest /services/server/info | table splunk_server version server_roles |
-  join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"|
-  table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull
-  value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert",
-  sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as
-  "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`'
-how_to_implement: The user running this search is required to have a permission allowing
-  them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability)
-  in some architectures. Splunk SOAR customers can find a SOAR workbook that walks
-  an analyst through the process of running these hunting searches in the references
-  list of this detection. In order to use this workbook, a user will need to run a
-  curl command to post the file to their SOAR instance such as "curl -u username:password
-  https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json".
-  A user should then create an empty container or case, attach the workbook, and begin
-  working through the tasks.
-known_false_positives: No known at this time.
-references:
-- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html
-- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 100
-  cve:
-  - CVE-2022-32153
-  impact: 50
-  message: $splunk_server$ may not be properly validating TLS Certificates
-  mitre_attack_id:
-  - T1587.003
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - none
-  risk_score: 50
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
-    source: audittrail
-    sourcetype: audittrail
-    update_timestamp: true
-    custom_index: _audit

detections/application/splunk_digital_certificates_lack_of_encryption.yml

@@ -1,72 +0,0 @@
-name: Splunk Digital Certificates Lack of Encryption
-id: 386a7ebc-737b-48cf-9ca8-5405459ed508
-version: 2
-date: '2024-05-18'
-author: Lou Stella, Splunk
-status: production
-type: Anomaly
-description: The following analytic identifies Splunk forwarder connections that are
-  not using TLS encryption. It leverages data from the `splunkd` logs, specifically
-  looking for connections where the `ssl` field is set to "false". This activity is
-  significant because unencrypted connections can expose sensitive data and allow
-  unauthorized access, posing a security risk. If confirmed malicious, an attacker
-  could exploit this vulnerability to download or publish forwarder bundles, potentially
-  leading to arbitrary code execution and further compromise of the environment.
-data_source:
-- Splunk
-search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp)
-  latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`'
-how_to_implement: This anomaly search looks for forwarder connections that are not
-  currently using TLS. It then presents the source IP, the type of forwarder, and
-  the version of the forwarder. You can also remove the "ssl=false" argument from
-  the initial stanza in order to get a full list of all your forwarders that are sending
-  data, and the version of Splunk software they are running, for audit purposes. Splunk
-  SOAR customers can find a SOAR workbook that walks an analyst through the process
-  of running these hunting searches in the references list of this detection. In order
-  to use this workbook, a user will need to run a curl command to post the file to
-  their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template
-  -d @splunk_psa_0622.json". A user should then create an empty container or case,
-  attach the workbook, and begin working through the tasks.
-known_false_positives: None at this time
-references:
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html
-- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 80
-  cve:
-  - CVE-2022-32151
-  impact: 25
-  message: $hostname$ is not using TLS when forwarding data
-  mitre_attack_id:
-  - T1587.003
-  observable:
-  - name: hostname
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - group
-  - ssl
-  - sourceIp
-  - fwdType
-  - version
-  - hostname
-  risk_score: 20
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log
-    source: /opt/splunk/var/log/splunk/metrics.log
-    sourcetype: splunkd
-    update_timestamp: false
-    custom_index: _internal

detections/application/splunk_dos_using_malformed_saml_request.yml

@@ -1,58 +0,0 @@
-name: Splunk DoS Using Malformed SAML Request
-id: 8e8a86d5-f323-4567-95be-8e817e2baee6
-version: 2
-date: '2024-05-29'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic detects a denial of service (DoS) attempt using
-  a malformed SAML request targeting the /saml/acs REST endpoint in Splunk Enterprise
-  versions lower than 9.0.6 and 8.2.12. It leverages `splunkd` logs, specifically
-  looking for error messages containing "xpointer" in the `expr` field. This activity
-  is significant because it can cause the Splunk daemon to crash or hang, disrupting
-  service availability. If confirmed malicious, this attack could lead to prolonged
-  downtime, impacting the organization's ability to monitor and respond to security
-  events.
-search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time)
-  as firstTime max(_time) as lastTime by component expr splunk_server event_message
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`'
-how_to_implement: To run this search, you must have access to the _internal index.
-known_false_positives: This search will show false positives. The analyst must look
-  for errors and a pointer indicating a malicious file.
-references:
-- https://advisory.splunk.com/advisories/SVD-2023-0802
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 30
-  impact: 50
-  message: Possible DoS attack against Splunk Server $splunk_server$
-  mitre_attack_id:
-  - T1498
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 15
-  required_fields:
-  - component
-  - expr
-  - host
-  - event_message
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk/splunk_dos_using_malformed_saml_request_splunkd.log
-    source: splunkd.log
-    sourcetype: splunkd
-    custom_index: _internal

detections/application/splunk_dos_via_dump_spl_command.yml

@@ -1,57 +0,0 @@
-name: Splunk DOS Via Dump SPL Command
-id: fb0e6823-365f-48ed-b09e-272ac4c1dad6
-version: 2
-date: '2024-05-03'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies a potential Denial of Service (DoS)
-  attack exploiting the dump SPL command in vulnerable Splunk Enterprise versions.
-  It detects this activity by searching the `splunk_crash_log` for segmentation fault
-  entries, indicating a crash of the Splunk daemon. This activity is significant for
-  a SOC because it can disrupt the availability of Splunk services, impacting monitoring
-  and incident response capabilities. If confirmed malicious, this attack could render
-  Splunk Enterprise unusable, severely hindering an organization's ability to detect
-  and respond to other security threats.
-search: '`splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`'
-how_to_implement: This search does not require additional ingestion of data. Requires
-  the ability to search _internal index and monitor segmentation faults.
-known_false_positives: Segmentation faults may occur due to other causes, so this
-  search may produce false positives
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  atomic_guid: []
-  confidence: 100
-  impact: 100
-  message: Possible denial of service attack with Victim $host$
-  mitre_attack_id:
-  - T1499.004
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  risk_score: 100
-  required_fields:
-  - host
-  - source
-  - event_message
-  - status
-  - _time
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_dos_via_dump_spl_command.log
-    source: /opt/splunk/var/log/splunk/splunkd.log
-    sourcetype: splunkd_crash_log
-    custom_index: _internal

detections/application/splunk_dos_via_malformed_s2s_request.yml

@@ -1,67 +0,0 @@
-name: Splunk DoS via Malformed S2S Request
-id: fc246e56-953b-40c1-8634-868f9e474cbd
-version: 3
-date: '2024-05-27'
-author: Lou Stella, Splunk
-status: production
-type: TTP
-description: The following analytic identifies attempts to exploit a Denial of Service
-  (DoS) vulnerability in the Splunk-to-Splunk (S2S) protocol by detecting malformed
-  S2S requests. It leverages `splunkd` logs, specifically looking for "ERROR" level
-  logs from the "TcpInputProc" component with the thread name "FwdDataReceiverThread"
-  and the message "Invalid _meta atom." This activity is significant as it targets
-  a known vulnerability that could disrupt Splunk services. If confirmed malicious,
-  this could lead to service outages, impacting the availability and reliability of
-  Splunk for monitoring and analysis.
-data_source:
-- Splunk
-search: '`splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread"
-  "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _internal index. This detection
-  will only find attempted exploitation on versions of Splunk already patched for
-  CVE-2021-3422.
-known_false_positives: None.
-references:
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 100
-  cve:
-  - CVE-2021-3422
-  impact: 50
-  message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$
-  mitre_attack_id:
-  - T1498
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  - name: src
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - host
-  - src
-  - log_level
-  - component
-  - thread_name
-  risk_score: 50
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
-    source: /opt/splunk/var/log/splunk/splunkd.log
-    sourcetype: splunkd
-    update_timestamp: true
-    custom_index: _internal

detections/application/splunk_dos_via_post_request_datamodel_endpoint.yml

@@ -1,56 +0,0 @@
-name: Splunk DoS via POST Request Datamodel Endpoint
-id: 45766810-dbb2-44d4-b889-b4ba3ee0d1f5
-version: 1
-status: production
-date: '2024-07-01'
-author: Rod Soto
-type: Hunting
-data_source: []
-description: The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint.
-search: >-
-  `splunkd_webs` log_level=INFO message="ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('127.0.0.1', 8065)) shut down" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server message 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `splunk_dos_via_post_request_datamodel_endpoint_filter`
-how_to_implement: Need access to the internal indexes.
-known_false_positives: This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs. 
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0710
-cve:
-- CVE-2024-36986
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 50
-  impact: 100
-  kill_chain_phases:
-  - Exploitation
-  message: Possible Denial of Service attack against $splunk_server$
-  mitre_attack_id:
-  - T1499
-  nist:
-  - DE.CM
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - UPDATE
-  risk_score: 15
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0710_web_service_splunk_web_service.log
-    source: /opt/splunk/var/log/splunk/web_service.log
-    sourcetype: splunk_web_service
-    custom_index: _internal

detections/application/splunk_dos_via_printf_search_function.yml

@@ -1,62 +0,0 @@
-name: Splunk DOS via printf search function
-id: 78b48d08-075c-4eac-bd07-e364c3780867
-version: 2
-date: '2024-05-25'
-author: Rod Soto, Eric McGinnis, Splunk
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies the use of the `printf` SPL function
-  in Splunk searches, which can be exploited for a denial of service (DoS) attack.
-  It detects this activity by querying the `audit_searches` data source for specific
-  patterns involving `makeresults`, `eval`, `fieldformat`, and `printf` functions,
-  excluding searches by the `splunk_system_user`. This activity is significant because
-  it targets a known vulnerability in Splunk Enterprise versions lower than 8.1.14,
-  8.2.12, 9.0.6, and 9.1.1, potentially disrupting the availability of the Splunk
-  instance. If confirmed malicious, this could lead to service outages and impact
-  the monitoring and logging capabilities of the organization.
-search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user"
-  search!="*audit_searches*" | stats count by user splunk_server host search | convert
-  ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
-how_to_implement: This search requires the ability to search internal indexes.
-known_false_positives: This search may produces false positives, analyst most focuse
-  in the use of printf conversion function of eval to craft an expression that splunkd
-  cannot interpret correctly causing it to crash.
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 100
-  impact: 100
-  message: Possible denial of service attack against $host$
-  cve:
-  - CVE-2023-40594
-  mitre_attack_id:
-  - T1499.004
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 100
-  required_fields:
-  - user
-  - splunk_server
-  - host
-  - search
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit

detections/application/splunk_edit_user_privilege_escalation.yml

@@ -1,65 +0,0 @@
-name: Splunk Edit User Privilege Escalation
-id: 39e1c326-67d7-4c0d-8584-8056354f6593
-version: 2
-date: '2024-05-15'
-author: Rod Soto, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies attempts by low-privilege users to
-  escalate their privileges to admin by exploiting the edit_user capability. It detects
-  this activity by analyzing audit trail logs for specific actions such as "change_own_password"
-  and "edit_password" where the info field is "granted" and the user is not an admin
-  or system user. This activity is significant because it indicates potential privilege
-  escalation, which is a critical security concern. If confirmed malicious, this could
-  allow an attacker to gain administrative access, leading to full control over the
-  Splunk environment and potential data breaches.
-search: '`audittrail` action IN ("change_own_password","password_change","edit_password")
-  AND info="granted" AND NOT user IN (admin, splunk-system-user) | stats earliest(_time)
-  as event_time values(index) as index values(sourcetype) as sourcetype values(action)
-  as action values(info) as info by user | `splunk_edit_user_privilege_escalation_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _audit index. This detection may
-  assist in efforts to discover abuse of edit_user privilege.
-known_false_positives: This search may produce false positives as password changing
-  actions may be part of normal behavior. Operator will need to investigate these
-  actions in order to discern exploitation attempts.
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  atomic_guid: []
-  confidence: 80
-  impact: 80
-  cve:
-  - CVE-2023-32707
-  message: Possible attempt to abuse edit_user function by $user$
-  mitre_attack_id:
-  - T1548
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  required_fields:
-  - user
-  - action
-  - info
-  - _time
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_edit_user_privilege_escalation.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit

detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml

@@ -1,60 +0,0 @@
-name: Splunk Endpoint Denial of Service DoS Zip Bomb
-id: b237d393-2f57-4531-aad7-ad3c17c8b041
-version: 2
-date: '2024-05-27'
-author: Marissa Bower, Rod Soto, Splunk
-status: production
-type: TTP
-description: The following analytic identifies crashes in the Splunk search app caused
-  by specially crafted ZIP files, affecting Universal Forwarder versions 8.1.11 and
-  8.2 versions below 8.2.7.1. It detects this activity by monitoring Universal Forwarder
-  error logs for specific messages indicating invalid or binary file issues. This
-  activity is significant because it can disrupt Splunk operations, leading to potential
-  data loss or monitoring gaps. If confirmed malicious, this attack could result in
-  a denial of service, hindering the organization's ability to monitor and respond
-  to other security incidents effectively.
-data_source:
-- Splunk
-search: '`splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary*
-  |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`'
-how_to_implement: Need to monitor Splunkd data from Universal Forwarders.
-known_false_positives: This search may reveal non malicious zip files causing errors
-  as well.
-references:
-- https://en.wikipedia.org/wiki/ZIP_(file_format)
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 75
-  cve:
-  - CVE-2022-37439
-  impact: 100
-  message: Potential exposure of environment variables from url embedded in dashboard
-  mitre_attack_id:
-  - T1499
-  observable:
-  - name: host
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - source
-  - component
-  - event_message
-  - host
-  risk_score: 75
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log
-    source: /opt/splunkforwarder/var/log/splunk/splunkd.log
-    sourcetype: splunkd
-    custom_index: _internal

detections/application/splunk_enterprise_kv_store_incorrect_authorization.yml

@@ -1,63 +0,0 @@
-name: Splunk Enterprise KV Store Incorrect Authorization
-id: 8f0e8380-a835-4f2b-b749-9ce119364df0
-version: 2
-date: '2024-05-10'
-author: Rod Soto, Eric McGinnis, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic detects unauthorized attempts to reload Splunk
-  KV Store collections via the REST API. It leverages internal index logs to identify
-  POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload`
-  endpoint, focusing on status codes starting with '2'. This activity is significant
-  as it may indicate improper permission handling, potentially leading to unauthorized
-  deletion of KV Store collections. If confirmed malicious, this could result in data
-  loss or unauthorized data manipulation, impacting the integrity and availability
-  of critical Splunk data.
-search: '`splunkda` uri=/servicesNS/nobody/search/admin/collections-conf/_reload status=2*
-  method="POST" user=* file=_reload | stats count min(_time) as firstTime max(_time)
-  as lastTime values(status) as status by host clientip file method | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `splunk_enterprise_kv_store_incorrect_authorization_filter`'
-how_to_implement: Requires access to internal indexes and REST API enabled instances.
-known_false_positives: This is a hunting search and will produce false positives.
-  Operator must follow results into instances where curl requests coming from actual
-  users may indicate intent of exploitation.
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0105
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  confidence: 50
-  impact: 50
-  message: Possible attempt to access KV Store collections at $host$
-  mitre_attack_id:
-  - T1548
-  cve:
-  - CVE-2024-23675
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Cloud
-  risk_score: 25
-  required_fields:
-  - uri
-  - status
-  - method
-  - file
-  - clientip
-  - host
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_enterprise_kv_store_incorrect_authorization_splunkd_access.log
-    source: /opt/splunk/var/log/splunk/splunkd_access.log
-    sourcetype: splunkd_access
-    custom_index: _internal

detections/application/splunk_enterprise_windows_deserialization_file_partition.yml

@@ -1,63 +0,0 @@
-name: Splunk Enterprise Windows Deserialization File Partition
-id: 947d4d2e-1b64-41fc-b32a-736ddb88ce97
-version: 3
-date: '2024-07-01'
-author: Rod Soto, Eric McGinnis, Chase Franklin
-status: production
-type: TTP
-data_source:
-- Splunk
-description: The following analytic identifies attempts to exploit a deserialization
-  vulnerability in Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3. It
-  detects irregular path file executions by analyzing `splunk_python` logs and extracting
-  file paths and names. This activity is significant because it indicates potential
-  exploitation of a known vulnerability, which could lead to arbitrary code execution.
-  If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary
-  code, and potentially compromise the entire Splunk environment, leading to data
-  breaches and further system exploitation.
-search: '`splunk_python` request_path="/*/app/search/C:\\Program" *strings* |
-  rex "request_path=(?<file_path>[^\"]+)" | rex field=file_path "[^\"]+/(?<file_name>[^\"\''\s/\\\\]+)"
-  | stats min(_time) as firstTime max(_time) as lastTime values(file_path) as file_path
-  values(file_name) as file_name by index, sourcetype, host | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `splunk_enterprise_windows_deserialization_file_partition_filter`'
-how_to_implement: Requires access to internal indexes. This detection search will
-  display irregular path file execution, which will display exploit attempts. Only
-  applies to Microsoft Windows Splunk versions.
-known_false_positives: Irregular path with files that may be purposely called for
-  benign reasons may produce false positives.
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0108
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  confidence: 90
-  impact: 100
-  message: Possible Windows Deserialization exploitation via irregular path file against
-    $host$
-  mitre_attack_id:
-  - T1190
-  cve:
-  - CVE-2024-23678
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  risk_score: 90
-  required_fields:
-  - request_path
-  - field
-  - file_name
-  - host
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_enterprise_windows_deserialization_file_partition_splunk_python.log
-    source: C:\Program File\Splunk\var\log\splunk\python.log
-    sourcetype: splunk_python
-    custom_index: _internal

detections/application/splunk_es_dos_investigations_manager_via_investigation_creation.yml

@@ -1,66 +0,0 @@
-name: Splunk ES DoS Investigations Manager via Investigation Creation
-id: 7f6a07bd-82ef-46b8-8eba-802278abd00e
-version: 2
-date: '2024-05-25'
-author: Rod Soto, Eric McGinnis, Chase Franklin
-status: production
-type: TTP
-data_source:
-- Splunk
-description: The following analytic detects the creation of malformed Investigations
-  in Splunk Enterprise Security (ES) versions lower than 7.1.2, which can lead to
-  a denial of service (DoS). It leverages internal Splunk logs, specifically monitoring
-  the `splunkd_investigation_rest_handler` with error statuses during investigation
-  creation. This activity is significant as it can disrupt the functionality of the
-  Investigations manager, hindering incident response efforts. If confirmed malicious,
-  this could prevent security teams from accessing critical investigation data, severely
-  impacting their ability to manage and respond to security incidents effectively.
-search: '`splunkd_investigation_rest_handler` method=put msg=*investigation* status=error
-  | stats count min(_time) as firstTime max(_time) as lastTime by user host method
-  msg | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |
-  `splunk_es_dos_investigations_manager_via_investigation_creation_filter`'
-how_to_implement: This search requires access to internal indexes. Only affects Splunk
-  Enterprise Security versions lower than 7.1.2.
-known_false_positives: The vulnerability requires an authenticated session and access
-  to create an Investigation. It only affects the availability of the Investigations
-  manager, but without the manager, the Investigations functionality becomes unusable
-  for most users. This search gives the exact offending event.
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0102
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 100
-  impact: 100
-  message: Denial of Service Attack against Splunk ES Investigation Manager by $user$
-  cve:
-  - CVE-2024-22165
-  mitre_attack_id:
-  - T1499
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise Security
-  risk_score: 100
-  required_fields:
-  - method
-  - msg
-  - status
-  - user
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_cve_2024_22165_investigation_rest_handler.log
-    source: /opt/splunk/var/log/splunk/investigation_handler.log
-    sourcetype: investigation_rest_handler
-    custom_index: _internal

detections/application/splunk_es_dos_through_investigation_attachments.yml

@@ -1,64 +0,0 @@
-name: Splunk ES DoS Through Investigation Attachments
-id: bb85b25e-2d6b-4e39-bd27-50db42edcb8f
-version: 2
-date: '2024-05-29'
-author: Rod Soto, Eric McGinnis, Chase Franklin
-status: production
-type: TTP
-data_source:
-- Splunk
-description: The following analytic detects attempts to perform a denial of service
-  (DoS) attack through investigation attachments in Splunk Enterprise Security (ES)
-  versions below 7.1.2. It leverages internal Splunk logs, specifically monitoring
-  the `splunkd_investigation_rest_handler` for error statuses related to investigation
-  objects. This activity is significant because it can render the Investigation feature
-  inaccessible, disrupting incident response and forensic analysis. If confirmed malicious,
-  this attack could prevent security teams from effectively managing and investigating
-  security incidents, leading to prolonged exposure and potential data breaches.
-search: '`splunkd_investigation_rest_handler` status=error object=investigation |
-  stats min(_time) as firstTime max(_time) as lastTime values(status) as status values(msg)
-  as msg values(id) as investigation_id by user | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `splunk_es_dos_through_investigation_attachments_filter`'
-how_to_implement: This search requires access to internal indexes, only affects Enterprise
-  Security versions below 7.1.2.
-known_false_positives: This search will show the exact DoS event via error message
-  and investigation id. The error however does not point exactly at the uploader as
-  any users associated with the investigation will be affected. Operator must investigate
-  using investigation id the possible origin of the malicious upload. Attack only
-  affects specific investigation not the investigation manager.
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0101
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 100
-  impact: 100
-  cve:
-  - CVE-2024-22164
-  message: Denial of Service detected at Splunk ES affecting $user$
-  mitre_attack_id:
-  - T1499
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise Security
-  risk_score: 100
-  required_fields:
-  - user
-  - status
-  - msg
-  - id
-  - object
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_cve_2024_22164_investigation_rest_handler.log
-    source: /opt/splunk/var/log/splunk/investigation_handler.log
-    sourcetype: investigation_rest_handler
-    custom_index: _internal

detections/application/splunk_http_response_splitting_via_rest_spl_command.yml

@@ -1,60 +0,0 @@
-name: Splunk HTTP Response Splitting Via Rest SPL Command
-id: e615a0e1-a1b2-4196-9865-8aa646e1708c
-version: 2
-date: '2024-05-27'
-author: Rod Soto, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies attempts to exploit an HTTP response
-  splitting vulnerability via the rest SPL command in Splunk. It detects this activity
-  by analyzing audit logs for specific search commands that include REST methods like
-  POST, PUT, PATCH, or DELETE. This behavior is significant because it indicates a
-  potential attempt to access restricted REST endpoints, which could lead to unauthorized
-  access to sensitive information. If confirmed malicious, this activity could allow
-  an attacker to access restricted content, such as password files, by injecting commands
-  into HTTP requests.
-search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*")
-  AND NOT search="*audit_searches*" | table user info has_error_msg search _time  |
-  `splunk_http_response_splitting_via_rest_spl_command_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _audit index. This search may assist
-  in detecting possible http response splitting exploitation attemptss.
-known_false_positives: This search may have produce false positives as malformed or
-  erroneous requests made to this endpoint may be executed willingly or erroneously
-  by operators.
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  atomic_guid: []
-  confidence: 50
-  impact: 50
-  message: Suspicious access by $user$
-  mitre_attack_id:
-  - T1027.006
-  observable:
-  - name: user
-    type: URL String
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  risk_score: 25
-  required_fields:
-  - search
-  - testing_endpoint
-  - info
-  - has_error_msg
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit

detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml

@@ -1,53 +0,0 @@
-name: Splunk Improperly Formatted Parameter Crashes splunkd
-id: 08978eca-caff-44c1-84dc-53f17def4e14
-version: 2
-date: '2024-05-14'
-author: Chase Franklin, Rod Soto, Splunk
-status: experimental
-type: TTP
-description: The following analytic detects the execution of improperly formatted
-  INGEST_EVAL parameters in Splunk Enterprise, which can crash the splunkd service.
-  It leverages the Splunk_Audit.Search_Activity datamodel to identify ad-hoc searches
-  containing specific keywords. This activity is significant because it can disrupt
-  Splunk operations, leading to potential data loss and service downtime. If confirmed
-  malicious, an attacker could exploit this to cause a denial of service, impacting
-  the availability and reliability of the Splunk environment.
-data_source: []
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"AND
-  Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc
-  Search_Activity.search!="*splunk_improperly_formatted_parameter_crashes_splunkd_filter*"
-  Search_Activity.user!=splunk-system-user by Search_Activity.search, Search_Activity.info,
-  Search_Activity.total_run_time, Search_Activity.user, Search_Activity.search_type
-  | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` |
-  `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`'
-how_to_implement: Requires access to audittrail and use of Splunk_Audit.Search_Activity
-  datamodel.
-known_false_positives: This is a hunting search it should be focused on affected products,
-  otherwise it is likely to produce false positives.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 100
-  cve:
-  - CVE-2023-22941
-  impact: 100
-  message: An attempt to exploit ingest eval parameter was detected from $user$
-  mitre_attack_id:
-  - T1499
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - user
-  - count
-  - info
-  risk_score: 100
-  security_domain: threat

detections/application/splunk_information_disclosure_in_splunk_add_on_builder.yml

@@ -1,57 +0,0 @@
-name: Splunk Information Disclosure in Splunk Add-on Builder
-id: b7b82980-4a3e-412e-8661-4531d8758735
-version: 2
-date: '2024-05-20'
-author: Rod Soto, Eric McGinnis
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies the presence of vulnerable versions
-  of Splunk Add-on Builder (below 4.1.4) that write sensitive information to internal
-  log files. It uses REST API queries to check installed app versions and flags those
-  below the secure threshold. This activity is significant because it exposes sensitive
-  data, which could be exploited by attackers. If confirmed malicious, this vulnerability
-  could lead to unauthorized access to sensitive information, compromising the security
-  and integrity of the Splunk environment. Immediate updates to version 4.1.4 or higher
-  are recommended.
-search: '| rest /services/apps/local | search disabled=0 core=0 label="Splunk Add-on
-  Builder" | dedup label | search version < 4.1.4 | eval WarningMessage="Splunk Add-on
-  Builder Versions older than v4.1.4 contain a critical vulnerability. Update to Splunk
-  Add-on Builder v4.1.4 or higher immediately. For more information about this vulnerability,
-  please refer to https://advisory.splunk.com/advisories/SVD-2024-0111" | table label
-  version WarningMessage | `splunk_information_disclosure_in_splunk_add_on_builder_filter`'
-how_to_implement: This search should be run on search heads where Splunk Add-on Builder
-  may be installed.  The results of this search will conclusively show whether or
-  not a vulnerable version of Splunk Add-on Builder is currently installed.
-known_false_positives: This search is highly specific for vulnerable versions of Splunk
-  Add-on Builder. There are no known false positives.
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0111
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  confidence: 100
-  impact: 100
-  message: Vulnerable $version$ of Splunk Add-on Builder found - Upgrade Immediately.
-  mitre_attack_id:
-  - T1082
-  observable:
-  - name: version
-    type: Other
-    role:
-    - Other
-  product:
-  - Splunk Enterprise
-  risk_score: 100
-  required_fields:
-  - disabled
-  - core
-  - version
-  - label
-  security_domain: endpoint
-  manual_test: This search uses a REST call against a running Splunk instance to fetch
-    the versions of installed apps. It cannot be replicated with a normal test or
-    attack data.
-

detections/application/splunk_information_disclosure_on_account_login.yml

@@ -1,60 +0,0 @@
-name: Splunk Information Disclosure on Account Login
-id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c
-version: 1
-date: '2024-07-01'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server. 
-search: '`splunkd` component=UiAuth status=failure action=login TcpChannelThread 
-  | stats count min(_time) as firstTime max(_time) as lastTime by user status action clientip 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `splunk_information_disclosure_on_account_login_filter`'
-how_to_implement: Requires access to internal indexes _internal.
-known_false_positives: This is a hunting search and requires operator to search for large number of login failures from several users indicating possible user enumeration attempts. May capture genuine login failures. 
-references:
-- https://advisory.splunk.com/SVD-2024-0716
-cve:
-- CVE-2024-36996
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 50
-  impact: 10
-  kill_chain_phases:
-  - Exploitation
-  message: Possible user enumeration attack against $clientip$
-  mitre_attack_id:
-  - T1087
-  nist:
-  - DE.CM
-  observable:
-  - name: clientip
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - user
-  - action
-  - status 
-  - clientip 
-  - host 
-  risk_score: 5
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/splunk/SVD-2024-0716_splunkd_splunkd.log
-    source: /opt/splunk/var/log/splunk/splunkd.log
-    sourcetype: splunkd
-    custom_index: _internal 

detections/application/splunk_list_all_nonstandard_admin_accounts.yml

@@ -1,57 +0,0 @@
-name: Splunk list all nonstandard admin accounts
-id: 401d689c-8596-4c6b-a710-7b6fdca296d3
-version: 2
-date: '2024-05-21'
-author: Rod Soto
-status: experimental
-type: Hunting
-description: 'The following analytic identifies nonstandard Splunk accounts with administrative
-  rights on the instance, excluding the default admin account. It uses REST API calls
-  to retrieve user data and filters for accounts with admin capabilities. This activity
-  is significant as unauthorized admin accounts can indicate potential security breaches
-  or misconfigurations. If confirmed malicious, attackers could leverage these accounts
-  to execute commands, escalate privileges, or persist within the environment, posing
-  a significant risk to the integrity and security of the Splunk instance.'
-data_source:
-- Splunk
-search: '| rest splunk_server=local /services/authentication/users |search capabilities=admin*
-  OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server
-  | `splunk_list_all_nonstandard_admin_accounts_filter`'
-how_to_implement: The user running this search is required to have a permission allowing
-  them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability)
-  in some architectures.  If there have been admin account, in addition to the standard
-  admin account, intentionally created on this server, then edit the filter macro
-  to exclude them.
-known_false_positives: It is not possible to discern from the user table whether or
-  not users with admin rights have been created intentionally, accidentally, or as
-  a result of exploitation. Each user with these rights should be investigated and,
-  if legitimate, added to the filter macro above.  If a user is not believed to be
-  legitimate, then further investigation should take place.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2023-22933
-  impact: 50
-  message: Potential stored XSS attempt from $host$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - capabilities
-  - splunk_server
-  - title
-  risk_score: 25
-  security_domain: endpoint

detections/application/splunk_low_privilege_user_can_view_hashed_splunk_password.yml

@@ -1,63 +0,0 @@
-name: Splunk Low Privilege User Can View Hashed Splunk Password
-id: a1be424d-e59c-4583-b6f9-2dcc23be4875
-version: 2
-date: '2024-05-29'
-author: Rod Soto, Eric McGinnis, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies low-privilege users attempting to view
-  hashed Splunk passwords by querying the conf-user-seed REST endpoint. It leverages
-  data from the `splunkd_web` logs, specifically monitoring access to the conf-user-seed
-  endpoint. This activity is significant because it can indicate an attempt to escalate
-  privileges by obtaining hashed credentials, potentially leading to admin account
-  takeover. If confirmed malicious, this could allow an attacker to gain administrative
-  control over the Splunk instance, compromising the entire environment's security.
-search: '`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" |
-  stats earliest(_time) as event_time values(method) as method values(status) as status
-  values(clientip) as clientip values(useragent) as useragent values(file) as file
-  by user | convert ctime(*time) | `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _audit index. This detection may
-  assist in efforts to discover attempts to access con-user-seed file content.
-known_false_positives: This search may produce false positives as accounts with high
-  privileges may access this file. Operator will need to investigate these actions
-  in order to discern exploitation attempts.
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  atomic_guid: []
-  confidence: 90
-  impact: 90
-  message: Attempt to access Splunk hashed password file from $clientip$
-  mitre_attack_id:
-  - T1212
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  risk_score: 81
-  required_fields:
-  - _time
-  - clientip
-  - useragent
-  - file
-  - user
-  - method
-  - status
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/splunk/splunk_low_privilege_user_can_view_hashed_splunk_password.log
-    source: /opt/splunk/var/log/splunk/web_access.log
-    sourcetype: splunk_web_access
-    custom_index: _internal

detections/application/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml

@@ -1,63 +0,0 @@
-name: Splunk Path Traversal In Splunk App For Lookup File Edit
-id: 8ed58987-738d-4917-9e44-b8ef6ab948a6
-version: 2
-date: '2024-05-22'
-author: Rod Soto, Eric McGinnis
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies path traversal attempts in the Splunk
-  App for Lookup File Editing. It detects specially crafted web requests targeting
-  lookup files by analyzing the `uri_query` field in the `_internal` index. This activity
-  is significant because it allows low-privilege users to read and write to restricted
-  areas of the Splunk installation directory, potentially accessing sensitive files
-  like password hashes. If confirmed malicious, this could lead to unauthorized access,
-  data breaches, and further exploitation of the Splunk environment.
-search: '`splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file
-  owner namespace  version | stats count by clientip namespace lookup_file uri_query
-  | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _internal index. This detection
-  is meant for on premise environments, and if executed on internet facing servers
-  without a WAF may produce a lot of results. This detection will not work against
-  obfuscated path traversal requests.
-known_false_positives: This search may find additional path traversal exploitation
-  attempts or malformed requests.
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  atomic_guid: []
-  confidence: 80
-  impact: 50
-  message: Path traversal exploitation attempt from $clientip$
-  mitre_attack_id:
-  - T1083
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  risk_score: 40
-  required_fields:
-  - clientip
-  - uri_query
-  - event_message
-  - lookup_file
-  - owner
-  - method
-  - user
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.log
-    source: splunkd_access
-    sourcetype: splunkd_access
-    custom_index: _internal

detections/application/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml

@@ -1,62 +0,0 @@
-name: Splunk Persistent XSS Via URL Validation Bypass W Dashboard
-id: 8a43558f-a53c-4ee4-86c1-30b1e8ef3606
-version: 2
-date: '2024-05-20'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic detects attempts to bypass URL validation in Splunk
-  Enterprise versions below 9.0.4, 8.2.10, and 8.1.13 by targeting the vulnerable
-  bootstrap version 2.3.1. It leverages `splunkd_web` logs, specifically monitoring
-  GET requests to JavaScript files within the vulnerable bootstrap path. This activity
-  is significant as it can allow a low-privileged user to perform path traversal,
-  potentially accessing restricted and confidential information. If confirmed malicious,
-  this could lead to unauthorized data access and compromise of sensitive information,
-  including targeting admin users.
-search: '`splunkd_web` method=GET uri_path="*bootstrap-2.3.1*" file="*.js" | table
-  _time clientip uri_path file status | `splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter`'
-how_to_implement: This search does not require additional data to be ingested. This
-  search requires ability to search _internal index. This search helps discover access
-  to vulnerable bootstrap versions.
-known_false_positives: This search will produce numerous false positives as it shows
-  ANY accesses to vulnerable bootstrap Javascript files.  Accesses to these files
-  occur during normal Splunk usage. To reduce or eliminate false positives, update
-  the a version of Splunk which has addressed the vulnerability.
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  atomic_guid: []
-  confidence: 20
-  impact: 80
-  cve:
-  - CVE-2019-8331
-  message: Attempted access to vulnerable bootstrap file by $clientip$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  risk_score: 16
-  required_fields:
-  - file
-  - uri
-  - clientip
-  - user
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.log
-    source: /opt/splunk/var/log/splunk/web_access.log
-    sourcetype: splunk_web_access
-    custom_index: _internal

detections/application/splunk_process_injection_forwarder_bundle_downloads.yml

@@ -1,68 +0,0 @@
-name: Splunk Process Injection Forwarder Bundle Downloads
-id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e
-version: 2
-date: '2024-05-23'
-author: Lou Stella, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies unauthorized forwarder bundle downloads
-  from Splunk Deployment Servers. It leverages native Splunk logs, specifically the
-  `splunkd` component "PackageDownloadRestHandler," to detect instances where an unauthenticated
-  client may have downloaded forwarder bundles. This activity is significant because
-  it could indicate a potential security breach, allowing unauthorized access to sensitive
-  configurations and applications. If confirmed malicious, an attacker could gain
-  insights into the deployment server's environment, potentially leading to further
-  exploitation or lateral movement within the network.
-data_source:
-- Splunk
-search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass)
-  by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`'
-how_to_implement: This hunting search uses native logs produced when a deployment
-  server is within your environment. Splunk SOAR customers can find a SOAR workbook
-  that walks an analyst through the process of running these hunting searches in the
-  references list of this detection. In order to use this workbook, a user will need
-  to run a curl command to post the file to their SOAR instance such as "curl -u username:password
-  https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json".
-  A user should then create an empty container or case, attach the workbook, and begin
-  working through the tasks.
-known_false_positives: None at this time.
-references:
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html
-- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 70
-  cve:
-  - CVE-2022-32157
-  impact: 50
-  message: $peer$ downloaded apps from $host$
-  mitre_attack_id:
-  - T1055
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - component
-  - app
-  - serverclass
-  - peer
-  - host
-  risk_score: 35
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log
-    source: /opt/splunk/var/log/splunk/splunkd.log
-    sourcetype: splunkd
-    update_timestamp: false
-    custom_index: _internal

detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml

@@ -1,74 +0,0 @@
-name: Splunk Protocol Impersonation Weak Encryption Configuration
-id: 900892bf-70a9-4787-8c99-546dd98ce461
-version: 2
-date: '2024-05-28'
-author: Lou Stella, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies weak encryption configurations in Splunk
-  related to TLS validation within the httplib and urllib Python libraries. It uses
-  REST API calls to check specific configuration settings on the search head and its
-  peers, ensuring compliance with security advisories. This activity is significant
-  for a SOC as weak encryption can be exploited for protocol impersonation attacks,
-  leading to unauthorized access. If confirmed malicious, attackers could intercept
-  and manipulate data, compromising the integrity and confidentiality of the Splunk
-  environment.
-data_source:
-- Splunk
-search: '| rest /services/server/info | table splunk_server version server_roles |
-  join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig"
-  | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server
-  [| rest /servicesNS/nobody/search/configs/conf-web/settings |  table splunk_server
-  serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert",
-  sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName",
-  serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions"
-  | `splunk_protocol_impersonation_weak_encryption_configuration_filter`'
-how_to_implement: The user running this search is required to have a permission allowing
-  them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability).
-  Splunk SOAR customers can find a SOAR workbook that walks an analyst through the
-  process of running these hunting searches in the references list of this detection.
-  In order to use this workbook, a user will need to run a curl command to post the
-  file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template
-  -d @splunk_psa_0622.json". A user should then create an empty container or case,
-  attach the workbook, and begin working through the tasks.
-known_false_positives: While all of the settings on each device returned by this search
-  may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY
-  in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python
-  configuration.
-references:
-- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html
-- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 100
-  cve:
-  - CVE-2022-32151
-  impact: 50
-  message: $splunk_server$ may not be properly validating TLS Certificates
-  mitre_attack_id:
-  - T1001.003
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - none
-  risk_score: 50
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
-    source: audittrail
-    sourcetype: audittrail
-    update_timestamp: true
-    custom_index: _audit

detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml

@@ -1,65 +0,0 @@
-name: Splunk protocol impersonation weak encryption selfsigned
-id: c76c7a2e-df49-414a-bb36-dce2683770de
-version: 2
-date: '2024-05-21'
-author: Rod Soto, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies the use of Splunk's default self-signed
-  certificates, which are flagged as insecure. It detects events from the `splunkd`
-  log where the event message indicates that an X509 certificate should not be used.
-  This activity is significant because using weak encryption and self-signed certificates
-  can expose the system to man-in-the-middle attacks and other security vulnerabilities.
-  If confirmed malicious, attackers could impersonate Splunk services, intercept sensitive
-  data, and compromise the integrity of the Splunk environment.
-data_source:
-- Splunk
-search: '`splunkd` certificate event_message="X509 certificate* should not be used*"
-  | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`'
-how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply
-  this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst
-  through the process of running these hunting searches in the references list of
-  this detection. In order to use this workbook, a user will need to run a curl command
-  to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template
-  -d @splunk_psa_0622.json". A user should then create an empty container or case,
-  attach the workbook, and begin working through the tasks.
-known_false_positives: This searches finds self signed certificates issued by Splunk
-  which are not recommended from Splunk version 9 forward.
-references:
-- https://www.splunk.com/en_us/product-security
-- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
-- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 80
-  cve:
-  - CVE-2022-32152
-  impact: 50
-  message: Splunk default issued certificate at $host$
-  mitre_attack_id:
-  - T1588.004
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - host
-  - CN
-  - event_message
-  risk_score: 40
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt
-    source: /opt/splun/var/log/splunk/splunkd.log
-    sourcetype: splunkd
-    custom_index: _internal

detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml

@@ -1,68 +0,0 @@
-name: Splunk protocol impersonation weak encryption simplerequest
-id: 839d12a6-b119-4d44-ac4f-13eed95412c8
-version: 2
-date: '2024-05-23'
-author: Rod Soto, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies instances where Splunk's Python3 client
-  libraries fail to validate SSL certificates properly. It leverages logs from `splunk_python`
-  to detect when "simpleRequest SSL certificate validation is enabled without hostname
-  verification." This activity is significant because improper SSL certificate validation
-  can expose the system to man-in-the-middle attacks, allowing attackers to intercept
-  or alter data. If confirmed malicious, this vulnerability could lead to unauthorized
-  access, data breaches, and potential system compromise. Upgrading to Splunk version
-  9 and configuring TLS hostname validation is recommended to mitigate this risk.
-data_source:
-- Splunk
-search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without
-  hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`'
-how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation
-  for Splunk Python modules in order to apply this search. Splunk SOAR customers can
-  find a SOAR workbook that walks an analyst through the process of running these
-  hunting searches in the references list of this detection. In order to use this
-  workbook, a user will need to run a curl command to post the file to their SOAR
-  instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template
-  -d @splunk_psa_0622.json". A user should then create an empty container or case,
-  attach the workbook, and begin working through the tasks.
-known_false_positives: This search tries to address validation of server and client
-  certificates within Splunk infrastructure, it might produce results from accidental
-  or unintended requests to port 8089.
-references:
-- https://www.splunk.com/en_us/product-security
-- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
-- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 80
-  cve:
-  - CVE-2022-32152
-  impact: 50
-  message: Failed to validate certificate on $host$
-  mitre_attack_id:
-  - T1588.004
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - host
-  - event_message
-  - path
-  risk_score: 40
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt
-    source: /opt/splunk/var/log/splunk/splunkd.log
-    sourcetype: splunk_python
-    custom_index: _internal

detections/application/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml

@@ -1,60 +0,0 @@
-name: Splunk RBAC Bypass On Indexing Preview REST Endpoint
-id: bbe26f95-1655-471d-8abd-3d32fafa86f8
-version: 2
-date: '2024-05-15'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies unauthorized attempts to use the /services/indexing/preview
-  REST endpoint in Splunk. It detects POST requests to this endpoint by monitoring
-  the _internal index for specific URI patterns. This activity is significant because
-  it indicates a potential RBAC (Role-Based Access Control) bypass, allowing unauthorized
-  users to overwrite search results if they know the search ID (SID) of an existing
-  job. If confirmed malicious, this could lead to data manipulation, unauthorized
-  access to sensitive information, and compromised integrity of search results.
-search: '`splunkda` method="POST" uri="*/services/indexing/preview*" | table host
-  clientip status useragent user uri_path | `splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter`'
-how_to_implement: This search does not require additional data ingestion. It requires
-  the ability to search _internal index.
-known_false_positives: This is a hunting search which provides verbose results against
-  this endpoint. Operator must consider things such as IP address, useragent and user(specially
-  low privelege) and host to investigate possible attack.
-references:
-- https://advisory.splunk.com/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  atomic_guid: []
-  confidence: 50
-  impact: 30
-  message: Review $clientip$ access to indexing preview endpoint from low privilege
-    user
-  mitre_attack_id:
-  - T1134
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  risk_score: 15
-  required_fields:
-  - host
-  - clientip
-  - status
-  - useragent
-  - user
-  - uri_path
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134/splunk/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.log
-    source: splunkd_access.log
-    sourcetype: splunkd_access
-    custom_index: _internal

detections/application/splunk_rce_pdfgen_render.yml

@@ -1,57 +0,0 @@
-name: Splunk RCE PDFgen Render
-id: bc2b7437-0400-438b-9537-21ab5b7d2d53
-version: 1
-date: '2024-07-01'
-status: production
-author: Rod Soto, Chase Franklin
-type: TTP
-data_source:
-- Splunk
-description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote 
-search: 'index=_internal sourcetype=splunk_pdfgen _raw IN ("*base64*", "*lambda*", "*system*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host, _raw
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `splunk_rce_pdfgen_render_filter`'
-how_to_implement: Requires access to internal indexes. 
-known_false_positives: This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives. 
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0701
-cve:
-- CVE-2024-36982
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 100
-  impact: 80
-  kill_chain_phases:
-  - Exploitation
-  message: Possible exploitation against $host$
-  mitre_attack_id:
-  - T1210
-  nist:
-  - DE.CM
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - host
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0701_pdfgen_log_splunk_pdfgen.log
-    source: /opt/splunk/var/log/splunk/pdfgen.log
-    sourcetype: splunk_pdfgen
-    custom_index: _internal
-

detections/application/splunk_rce_via_external_lookup_copybuckets.yml

@@ -1,56 +0,0 @@
-name: Splunk RCE via External Lookup Copybuckets
-id: 8598f9de-bba8-42a4-8ef0-12e1adda4131
-version: 1
-date: '2024-07-01'
-status: production
-author: Rod Soto, Chase Franklin
-type: Hunting
-data_source:
-- Splunk
-description: The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup.
-search: 'index=_internal sourcetype="splunk_archiver-too_small" *.csv
-  | rex field=_raw "Invoking command:\s(?<command>.*)" 
-  | stats min(_time) as firstTime max(_time) as lastTime values(command) as command values(severity) as severity by host
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `splunk_rce_via_external_lookup_copybuckets_filter`'
-how_to_implement: Requires access to internal indexes
-known_false_positives: An operator must identify elements indicatives of command execution requests by looking at regex data being extracted from the log. Not all the requests will be malicious. 
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0705
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities 
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 100
-  impact: 80
-  kill_chain_phases:
-  - Exploitation
-  message: Possible exploitation attempt against $host$
-  mitre_attack_id:
-  - T1210
-  nist:
-  - DE.CM
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - host
-  risk_score: 80
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0705_splunk_archiver_splunk_archiver-too_small.log
-    source: /opt/splunk/var/log/splunk/splunk_archiver.log
-    sourcetype: splunk_archiver-too_small
-    update_timestamp: true
-    custom_index: _internal

detections/application/splunk_rce_via_serialized_session_payload.yml

@@ -1,66 +0,0 @@
-name: Splunk RCE via Serialized Session Payload
-id: d1d8fda6-874a-400f-82cf-dcbb59d8e4db
-version: 2
-date: '2024-05-26'
-author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
-status: production
-type: Hunting
-description: The following analytic detects the execution of a specially crafted query
-  using the 'collect' SPL command in Splunk Enterprise versions lower than 8.2.12,
-  9.0.6, and 9.1.1. It leverages audit logs to identify searches containing both 'makeresults'
-  and 'collect' commands. This activity is significant because it can indicate an
-  attempt to serialize untrusted data, potentially leading to arbitrary code execution.
-  If confirmed malicious, this could allow an attacker to execute code within the
-  Splunk environment, leading to unauthorized access and control over the system.
-data_source:
-- Splunk
-search: '`audit_searches` file=* (search="*makeresults*" AND search="*collect*") |
-  stats count min(_time) as firstTime max(_time) as lastTime by action file user splunk_server
-  search | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `splunk_rce_via_serialized_session_payload_filter`'
-how_to_implement: Requires access to the _audit index.
-known_false_positives: There are numerous many uses of the 'makeresults' and 'collect'
-  SPL commands. Please evaluate the results of this search for potential abuse.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2023-40595
-  impact: 50
-  message: Potential abuse of the 'collect' SPL command against $splunk_server$ by
-    detected by $user$
-  mitre_attack_id:
-  - T1190
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - search
-  - info
-  - user
-  - search_type
-  - count
-  risk_score: 25
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_rce_via_serialized_session_payload_audittrail.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit

detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml

@@ -1,66 +0,0 @@
-name: Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature
-id: baa41f09-df48-4375-8991-520beea161be
-version: 2
-date: '2024-05-16'
-author: Rod Soto
-status: production
-type: Hunting
-description: The following analytic identifies potential exploitation attempts against
-  the Splunk Secure Gateway App's Mobile Alerts feature in Splunk versions 9.0, 8.2.x,
-  and 8.1.x. It detects suspicious activity by monitoring requests to the mobile alerts
-  endpoint using specific URI paths and query parameters. This activity is significant
-  because an authenticated user could exploit this vulnerability to execute arbitrary
-  operating system commands remotely. If confirmed malicious, this could lead to unauthorized
-  code execution, compromising the integrity and security of the Splunk environment.
-data_source:
-- Splunk
-search: '`splunkda` uri_path="/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*"
-  sort="notification.created_at:-1" | table  clientip file host method uri_query sort
-  | `splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter`'
-how_to_implement: This search only applies if Splunk Mobile Gateway is deployed in
-  the vulnerable Splunk versions.
-known_false_positives: This detection does not require you to ingest any new data.
-  The detection does require the ability to search the _internal index. Focus of this
-  search is 
-  "uri_path=/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*"
-  which is the injection point.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 90
-  cve:
-  - CVE-2022-43567
-  impact: 90
-  message: Possible exploitation attempt from $clientip$
-  mitre_attack_id:
-  - T1210
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - uri_path
-  - clientip
-  - file
-  - host
-  - method
-  - sort
-  risk_score: 81
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_secure_gateway_splunk_mobile_alerts_feature.txt
-    source: /opt/splunk/var/log/splunk/splunkd_access.log
-    sourcetype: splunkd_access
-    custom_index: _internal
-    update_timestamp: true

detections/application/splunk_rce_via_user_xslt.yml

@@ -1,68 +0,0 @@
-name: Splunk RCE via User XSLT
-id: 6cb7e011-55fb-48e3-a98d-164fa854e37e
-version: 2
-date: '2024-05-16'
-author: Marissa Bower, Chase Franklin, Rod Soto, Bhavin Patel, Eric McGinnis, Splunk
-status: production
-type: Hunting
-data_source: []
-description: The following analytic identifies potential remote code execution (RCE)
-  attempts via user-supplied Extensible Stylesheet Language Transformations (XSLT)
-  in Splunk versions 9.1.x. It detects this activity by analyzing `splunkd_ui` logs
-  for specific URI patterns and status codes indicative of XSLT injection attempts.
-  This activity is significant because successful exploitation could allow an attacker
-  to execute arbitrary code on the Splunk server. If confirmed malicious, this could
-  lead to full system compromise, unauthorized data access, and further lateral movement
-  within the network.
-search: '`splunkd_ui` ((uri="*NO_BINARY_CHECK=1*" AND "*input.path=*.xsl*") OR uri="*dispatch*.xsl*")
-  AND uri!= "*splunkd_ui*" | rex field=uri "(?<string>=\s*([\S\s]+))" | eval decoded_field=urldecode(string)
-  | eval action=case(match(status,"200"),"Allowed",match(status,"303|500|401|403|404|301|406"),"Blocked",1=1,"Unknown")
-  | stats count min(_time) as firstTime max(_time) as lastTime by clientip useragent
-  uri decoded_field action host | rename clientip as src, uri as dest_uri | iplocation
-  src | fillnull value="N/A" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | table firstTime, lastTime src, useragent, action, count, Country, Region, City, dest_uri, decoded_field
-  | `splunk_rce_via_user_xslt_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _internal index.
-known_false_positives: This search will provide information for investigation and
-  hunting possible abuse of user-supplied XSLT. There may be false positives and results
-  should individually evaluated. Please evaluate the source IP and useragent responsible
-  for creating the requests.
-references:
-- https://advisory.splunk.com/advisories/SVD-2023-1104
-cve:
-- CVE-2023-46214
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: Potential Remote Code Execution via XLST from $src$ using useragent - $useragent$
-  mitre_attack_id:
-  - T1210
-  observable:
-  - name: src
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  required_fields:
-  - uri
-  - clientip
-  - useragent
-  - action
-  - host
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_user_xslt_splunkd_ui_access.log
-    source: /opt/splunk/var/log/splunk/splunkd_ui_access.log
-    sourcetype: splunkd_ui_access
-    custom_index: _internal

detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml

@@ -1,68 +0,0 @@
-name: Splunk Reflected XSS in the templates lists radio
-id: d532d105-c63f-4049-a8c4-e249127ca425
-version: 2
-date: '2024-05-23'
-author: Rod Soto, Chase Franklin
-status: production
-type: Hunting
-description: The following analytic identifies potential reflected cross-site scripting
-  (XSS) attempts in Splunk versions below 8.1.12, 8.2.9, and 9.0.2. It detects when
-  a query parameter with `output_mode=radio` is used in a URI, leveraging `splunkd_webx`
-  logs with status 200 and non-null URI queries. This activity is significant as it
-  can indicate an attempt to exploit a known vulnerability, potentially allowing attackers
-  to execute arbitrary JavaScript in the context of the user's browser. If confirmed
-  malicious, this could lead to unauthorized actions, data theft, or further compromise
-  of the affected Splunk instance.
-data_source:
-- Splunk
-search: '`splunkd_webx` user=admin status=200 uri=*/lists/entities/x/ui/views* uri_query!=null
-  | stats count earliest(_time) as event_time values(status) as status values(clientip)
-  as clientip by index, sourcetype, _time, host, user, uri | `splunk_reflected_xss_in_the_templates_lists_radio_filter`'
-how_to_implement: This vulnerability only affects instances with Splunk Web enabled.
-  This detection does not require you to ingest any new data. The detection does require
-  the ability to search the _internal index.
-known_false_positives: This search may produce false positives as it is difficult
-  to pinpoint all possible XSS injection characters in a single search string. Special
-  attention is required to "en-US/list/entities/x/ui/views" which is the vulnerable
-  injection point.
-references:
-- https://research.splunk.com/stories/splunk_vulnerabilities/
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2022-43568
-  impact: 50
-  message: Potential XSS exploitation against radio template by $user$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - host
-  - clientip
-  - status
-  - user
-  - uri
-  - uri_query
-  - uri_path
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_in_templates_lists_radio.txt
-    source: /opt/splunk/var/log/splunk/web_access.log
-    sourcetype: splunk_web_access
-    custom_index: _internal
-    update_timestamp: true

detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml

@@ -1,64 +0,0 @@
-name: Splunk Reflected XSS on App Search Table Endpoint
-id: 182f9080-4137-4629-94ac-cb1083ac981a
-version: 2
-date: '2024-05-23'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies attempts to exploit a reflected cross-site
-  scripting (XSS) vulnerability on the app search table endpoint in Splunk Enterprise
-  versions below 9.1.1, 9.0.6, and 8.2.12. It detects this activity by analyzing web
-  request logs for specific dataset commands (`makeresults`, `count`, `eval`, `baseSPL`)
-  within the `splunkd_web` index. This activity is significant because successful
-  exploitation can lead to the execution of arbitrary commands on the Splunk platform,
-  potentially compromising the entire instance. If confirmed malicious, attackers
-  could gain unauthorized access, execute arbitrary code, and manipulate data within
-  the Splunk environment.
-search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*"
-  AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by clientip status user view root uri_path |
-  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_reflected_xss_on_app_search_table_endpoint_filter`'
-how_to_implement: Need access to the internal indexes.
-known_false_positives: This search will produce false positives. It is necessary to
-  also look at uri_query parameter to determine the possible malicious intention of
-  inserting makeresults within the uri string.
-references:
-- https://advisory.splunk.com/advisories/SVD-2023-0801
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 40
-  impact: 30
-  message: Possible XSS attack against from $user$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 12
-  required_fields:
-  - dataset_commands
-  - clientip
-  - status
-  - user
-  - view
-  - root
-  - uri_path
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_on_app_search_table_endpoint_splunk_web_access.log
-    source: web_access.log
-    sourcetype: splunk_web_access
-    custom_index: _internal

detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml

@@ -1,101 +0,0 @@
-name: Splunk risky Command Abuse disclosed february 2023
-id: ee69374a-d27e-4136-adac-956a96ff60fd
-version: 4
-date: '2024-07-01'
-author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies the execution of high-risk commands
-  associated with various Splunk vulnerability disclosures. It leverages the Splunk_Audit.Search_Activity
-  datamodel to detect ad-hoc searches by non-system users that match known risky commands.
-  This activity is significant for a SOC as it may indicate attempts to exploit known
-  vulnerabilities within Splunk, potentially leading to unauthorized access or data
-  exfiltration. If confirmed malicious, this could allow attackers to execute arbitrary
-  code, escalate privileges, or persist within the environment, posing a severe threat
-  to the organization's security posture.
-data_source:
-- Splunk
-search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time) as
-  lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc
-  Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info
-  Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type
-  | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command
-  as search output splunk_risky_command description vulnerable_versions CVE other_metadata
-  | where splunk_risky_command != "false" | `security_content_ctime(firstTime)` |
-  `security_content_ctime(lastTime)` | `splunk_risky_command_abuse_disclosed_february_2023_filter`'
-how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel.
-known_false_positives: This search encompasses many commands.
-references:
-- https://advisory.splunk.com/advisories
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  confidence: 50
-  cve:
-  - CVE-2023-22931
-  - CVE-2023-22934
-  - CVE-2023-22935
-  - CVE-2023-22936
-  - CVE-2023-22939
-  - CVE-2023-22940
-  - CVE-2023-40598
-  - CVE-2023-40598
-  - CVE-2023-46214
-  - CVE-2024-23676
-  - CVE-2024-36984
-  impact: 50
-  message: Use of risky splunk command $splunk_risky_command$ detected by $user$
-  mitre_attack_id:
-  - T1548
-  - T1202
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  - name: splunk_risky_command
-    type: Other
-    role:
-    - Other
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - search
-  - info
-  - user
-  - search_type
-  - count
-  risk_score: 25
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit
-- name: True Positive Test runshellscript abuse
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit
-- name: True Positive Test Additional runshellscript abuse
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit
-- name: True Positive Test mrollup abuse
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/splunk/splunk_mrollup_abuse_audittrail.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit

detections/application/splunk_stored_xss_conf_web_settings_on_premises.yml

@@ -1,57 +0,0 @@
-name: Splunk Stored XSS conf-web Settings on Premises
-id: ed1209ef-228d-4dab-9856-be9369925a5c
-version: 1
-date: '2024-07-01'
-author: Rod Soto, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user. 
-search: '`splunk_python` *script* *eval* 
-  | stats min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `splunk_stored_xss_conf_web_settings_on_premises_filter`'
-how_to_implement: Requires access to internal indexes.
-known_false_positives: This is a hunting search and will produce false positives, operator must identify XSS elemetns in the splunk_python log related to the vulnerable endpoint. 
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0717
-cve:
-- CVE-2024-36987
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 100
-  impact: 20
-  kill_chain_phases:
-  - Exploitation
-  message: Possible XSS attack against $host$
-  mitre_attack_id:
-  - T1189
-  nist:
-  - DE.CM
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - UPDATE
-  risk_score: 20
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0717_python_log_splunk_python.log
-    source: /opt/splunk/var/log/splunk/python.log
-    sourcetype: splunk_python
-    custom_index: _internal
-

detections/application/splunk_stored_xss_via_data_model_objectname_field.yml

@@ -1,68 +0,0 @@
-name: Splunk Stored XSS via Data Model objectName Field
-id: 062bff76-5f9c-496e-a386-cb1adcf69871
-version: 3
-date: '2024-07-01'
-author: Rod Soto
-status: production
-type: Hunting
-description: The following analytic identifies attempts to exploit a stored cross-site
-  scripting (XSS) vulnerability in Splunk Enterprise via the Data Model object name
-  field. It detects this activity by analyzing web access logs (`splunkd_webx`) for
-  specific URI patterns and non-null query parameters. This activity is significant
-  because it allows authenticated users to inject and store malicious scripts, leading
-  to persistent XSS attacks. If confirmed malicious, this could enable attackers to
-  execute arbitrary scripts in the context of other users, potentially leading to
-  data theft, session hijacking, or further compromise of the Splunk environment.
-data_source:
-- Splunk
-search: '`splunkd_webx` uri=/*/splunkd/__raw/servicesNS/*/launcher/datamodel/model*
-  uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`'
-how_to_implement: This vulnerability only affects Splunk Web enabled instances. This
-  detection does not require you to ingest any new data. The detection does require
-  the ability to search the _internal index.
-known_false_positives: This search may produce false positives and does not cover
-  exploitation attempts via code obfuscation, focus of search is suspicious requests
-  against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the
-  injection point.
-references:
-- https://advisory.splunk.com/advisories/SVD-2022-1109
-- https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2022-43569
-  impact: 50
-  message: A potential XSS attempt has been detected from $user$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - uri
-  - uri_query
-  - host
-  - status
-  - clientip
-  - user
-  - uri_path
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_stored_xss_via_data_model_objectname_field.txt
-    source: /opt/splunk/var/log/splunk/web_access.log
-    sourcetype: splunk_web_access
-    custom_index: _internal
-    update_timestamp: true

detections/application/splunk_stored_xss_via_specially_crafted_bulletin_message.yml

@@ -1,62 +0,0 @@
-name: Splunk Stored XSS via Specially Crafted Bulletin Message
-id: fd852b27-1882-4505-9f2c-64dfb96f4fc1
-version: 1
-date: '2024-07-01'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following hunting detection provides fields related to /service/messages endpoints where specially crafted bulletin message can exploit stored XSS. 
-search: '| rest /services/messages 
-  | search message="*http*"
-  | table id author message title 
-  | `splunk_stored_xss_via_specially_crafted_bulletin_message_filter`'
-how_to_implement: Need access to Splunk REST api data via search. 
-known_false_positives: Must look at messages field and find malicious suspicious characters or hyperlinks. Not all requests to this endpoint will be malicious. 
-references:
-- https://advisory.splunk.com/SVD-2024-0713
-cve:
-- CVE-2024-36993
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 50
-  impact: 10
-  kill_chain_phases:
-  - Exploitation
-  message: Please investigate $message for possible XSS attack in bulletin message $message$
-  mitre_attack_id:
-  - T1189
-  nist:
-  - DE.CM
-  observable:
-  - name: message
-    type: Other
-    role:
-    - Other
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - table
-  - id
-  - author
-  - message 
-  - title 
-  risk_score: 5
-  security_domain: endpoint
-  manual_test: This search uses a REST call against a running Splunk instance to fetch
-    messages that have been created on the instance. It cannot be replicated with a normal test or
-    attack data as this data cannot be "replayed" into a Splunk instance.
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0713_json_json.log
-    source: _json
-    sourcetype: _json
-    custom_index: _internal

detections/application/splunk_unauthenticated_dos_via_null_pointer_references.yml

@@ -1,56 +0,0 @@
-name: Splunk Unauthenticated DoS via Null Pointer References
-id: d67594fe-c317-41b8-9319-ec8428d5c2ea
-version: 1
-date: '2024-07-01'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following hunting search provides information on splunkd crash as a result of a Denial of Service Exploitation via null pointer references which targets 'services/cluster/config' endpoint.
-search: '`splunk_crash_log` "Segmentation fault" "POST /services/cluster/config" 
-  | stats count min(_time) as firstTime max(_time) as  lastTime by host 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `splunk_unauthenticated_dos_via_null_pointer_references_filter`'
-how_to_implement: Requires access to internal indexes. 
-known_false_positives: This is a hunting search and will produce false positives. An operator needs to find proximity and detail of requests targeting cluster config endpoint and subsequent Segmentation fault in splunk crash log. 
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0702 
-cve:
-- CVE-2024-36983
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 50
-  impact: 100
-  kill_chain_phases:
-  - Exploitation
-  message: Possible exploitation attack against $host$
-  mitre_attack_id:
-  - T1499
-  nist:
-  - DE.CM
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - sourcetype
-  risk_score: 15
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0702_splunkd_crash_log_splunkd_crash_log.log
-    source: /opt/splunk/var/log/splunk/crash-*.log
-    sourcetype: splunkd_crash_log
-    custom_index: _internal

detections/application/splunk_unauthenticated_log_injection_web_service_log.yml

@@ -1,67 +0,0 @@
-name: Splunk Unauthenticated Log Injection Web Service Log
-id: de3908dc-1298-446d-84b9-fa81d37e959b
-version: 2
-date: '2024-05-19'
-author: Rod Soto
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies potential log injection attempts into
-  the Splunk server via specially crafted web URLs. It detects ANSI escape codes within
-  the `uri_path` field of `splunkd_webx` logs. This activity is significant as it
-  can lead to log file manipulation, potentially obfuscating malicious actions or
-  misleading analysts. If confirmed malicious, an attacker could manipulate log files
-  to hide their tracks or execute further attacks, compromising the integrity of the
-  logging system and making incident response more challenging.
-search: '`splunkd_webx`  uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*")
-  | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`'
-how_to_implement: This only affects web enabled Splunk instances. The detection does
-  require the ability to search the _internal index.
-known_false_positives: This hunting search will produce false positives if ANSI escape
-  characters are included in URLs either voluntarily or by accident. This search will
-  not detect obfuscated ANSI characters.
-references:
-- https://advisory.splunk.com/advisories/SVD-2023-0606
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 30
-  impact: 30
-  message: Possible Splunk unauthenticated log injection web service log exploitation
-    attempt against $host$ from $clientip$
-  cve:
-  - CVE-2023-32712
-  mitre_attack_id:
-  - T1190
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 9
-  required_fields:
-  - method
-  - uri_path
-  - host
-  - status
-  - clientip
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/web_access.log
-    source: /opt/splunk/var/log/splunk/web_access.log
-    custom_index: _internal
-    sourcetype: splunk_web_access
-

detections/application/splunk_unauthenticated_path_traversal_modules_messaging.yml

@@ -1,57 +0,0 @@
-name: Splunk Unauthenticated Path Traversal Modules Messaging
-id: e7c2b064-524e-4d65-8002-efce808567aa
-version: 1
-date: '2024-07-01'
-author: Rod Soto, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: This hunting search provides information on exploitation attempts against /modules/messaging endpoint, the exploit can be clearly seen as the ../ which signals an attempt to traverse target directories.
-search: '`splunkd_web` method=GET uri_path="/*/modules/messaging/*..*" 
-  | stats min(_time) as firstTime max(_time) as lastTime values(method) as method values(uri_path) as uri_path by host 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `splunk_unauthenticated_path_traversal_modules_messaging_filter`'
-how_to_implement: Only applies to Microsoft Windows installations of Splunk.
-known_false_positives: May catch other exploitation attempts using path traversal related characters. 
-references:
-- https://advisory.splunk.com/SVD-2024-0711 
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 100
-  impact: 20
-  kill_chain_phases:
-  - Exploitation
-  message: Possible directory traversal attack against $host$
-  mitre_attack_id:
-  - T1083
-  nist:
-  - DE.CM
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - method
-  - uri_path
-  - host 
-  risk_score: 20
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/SVD-2024-0711_web_access_splunk_web_access.log
-    source: C:\\Program Files\\Splunk\\var\\log\\splunk\\web_access.log
-    sourcetype: splunk_web_access
-    custom_index: _internal
-

detections/application/splunk_unauthorized_experimental_items_creation.yml

@@ -1,60 +0,0 @@
-name: Splunk Unauthorized Experimental Items Creation
-id: 84afda04-0cd6-466b-869e-70d6407d0a34
-version: 1
-date: '2024-07-01'
-author: Rod Soto, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: This hunting search provides information on finding possible creation of unauthorized items against /experimental endpoint.
-search: '`splunkda` */experimental/* method=POST
-  | stats count min(_time) as firstTime max(_time) as lastTime by clientip method uri_path uri status 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `splunk_unauthorized_experimental_items_creation_filter`'
-how_to_implement: Requires access to internal indexes. 
-known_false_positives: Not all requests are going to be malicious, there will be false positives, however operator must find suspicious items that might have been created by an unauthorized user. 
-references:
-- https://advisory.splunk.com/SVD-2024-0715
-cve:
-- CVE-2024-36995
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 100
-  impact: 5
-  kill_chain_phases:
-  - Exploitation
-  message: Possible unauthorized creation of experimental items from $clientip$
-  mitre_attack_id:
-  - T1189
-  nist:
-  - DE.CM
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - clientip
-  - method
-  - uri_path
-  - uri 
-  - status
-  risk_score: 5
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0715_splunkd_splunkd_access.log
-    source: /opt/splunk/var/log/splunk/splunkd_access.log
-    sourcetype: splunkd_access
-    custom_index: _internal

detections/application/splunk_unauthorized_notification_input_by_user.yml

@@ -1,56 +0,0 @@
-name: Splunk Unauthorized Notification Input by User
-id: 4b7f368f-4322-47f8-8363-2c466f0b7030
-version: 1
-date: '2024-07-01'
-author: Rod Soto
-status: experimental
-type: Hunting
-data_source:
-- Splunk
-description: This hunting search provides information to track possible exploitation of a lower privilege user able to push notifications that may include malicious code as notifications for all users in Splunk. 
-search: '| rest /services/messages | table title message severity timeCreated_iso published splunk_server author | `splunk_unauthorized_notification_input_by_user_filter`'
-how_to_implement: Requires access to Splunk rest data. 
-known_false_positives: This search will produce false positives which may include benign notifications from other Splunk entities, attention to suspicious or anomalous elements in notifications helps identify actual exploitation of this vulnerability.   
-references:
-- https://advisory.splunk.com/advisories/SVD-2024-0709
-cve:
-- CVE-2023-33733
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 100
-  impact: 20
-  kill_chain_phases:
-  - Exploitation
-  message: Please review messages at $splunk_server for possible unauthorized notification input. 
-  mitre_attack_id:
-  - T1548
-  nist:
-  - DE.CM
-  observable:
-  - name: splunk_server
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - message
-  - title
-  - splunk_server
-  - author
-  risk_score: 12
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/SVD-2024-0709_json_json.json
-    source: _json
-    sourcetype: _json
-    custom_index: _internal
-

detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml

@@ -1,67 +0,0 @@
-name: Splunk unnecessary file extensions allowed by lookup table uploads
-id: b7d1293f-e78f-415e-b5f6-443df3480082
-version: 2
-date: "2024-05-28"
-author: Rod Soto, Splunk
-type: TTP
-status: production
-data_source:
-- Splunk
-description: The following analytic identifies user activity related to uploading
-  lookup tables with unnecessary filename extensions in Splunk Enterprise versions
-  below 8.1.13, 8.2.10, and 9.0.4. It detects this activity by monitoring HTTP methods
-  (POST, DELETE) and specific URI paths in the internal `splunkd_access` logs. This
-  behavior is significant because it can indicate attempts to upload potentially malicious
-  files disguised as lookup tables. If confirmed malicious, this activity could allow
-  an attacker to execute unauthorized code or manipulate data within the Splunk environment,
-  leading to potential data breaches or system compromise.
-search: '`splunkda` method IN ("POST", "DELETE") uri_path=/servicesNS/*/ui/views/*
-  | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions
-  Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method=="DELETE"
-  , "Deleted" ) | rex field=uri_path "(?<user_and_app>.*?)\/ui\/views/(?<dashboard_encoded>.*)"
-  | eval dashboard = urldecode( dashboard_encoded ) | table _time, uri_path, user,
-  dashboard, activity, uri_path | `splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter`'
-how_to_implement: Requires access to internal splunkd_access.
-known_false_positives: This is a hunting search, the search provides information on
-  upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary
-  after executing search. This search will produce false positives as payload cannot
-  be directly discerned.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  cve:
-  - CVE-2023-22937
-  confidence: 50
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
-  impact: 50
-  message: Potential lookup template injection attempt from $user$ on lookup table
-    at path $uri_path$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - user
-  - method
-  - uri_path
-  risk_score: 25
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
-    source: /opt/splunk/var/log/splunk/splunkd_access.log
-    sourcetype: splunkd_access
-    custom_index: _internal

detections/application/splunk_user_enumeration_attempt.yml

@@ -1,66 +0,0 @@
-name: Splunk User Enumeration Attempt
-id: 25625cb4-1c4d-4463-b0f9-7cb462699cde
-version: 3
-date: '2024-05-21'
-author: Lou Stella, Splunk
-status: production
-type: TTP
-description: The following analytic identifies attempts to enumerate usernames in
-  Splunk by detecting multiple failed authentication attempts from the same source.
-  It leverages data from the `_audit` index, specifically focusing on failed authentication
-  events. This activity is significant for a SOC because it can indicate an attacker
-  trying to discover valid usernames, which is a precursor to more targeted attacks
-  like password spraying or brute force attempts. If confirmed malicious, this activity
-  could lead to unauthorized access, compromising the security of the Splunk environment
-  and potentially exposing sensitive data.
-data_source:
-- Splunk
-search: ' `splunkd_failed_auths` | stats count(user) as auths by user, src | where
-  auths>5 | stats values(user) as user, sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _audit index. This detection may
-  assist in efforts to find password spraying or brute force authorization attempts
-  in addition to someone enumerating usernames.
-known_false_positives: Automation executing authentication attempts against your Splunk
-  infrastructure with outdated credentials may cause false positives.
-references:
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 80
-  cve:
-  - CVE-2021-33845
-  impact: 50
-  message: $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected.
-  mitre_attack_id:
-  - T1078
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: src
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - user
-  - src
-  - info
-  - action
-  risk_score: 40
-  security_domain: access
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log
-    source: audittrail
-    sourcetype: audittrail
-    custom_index: _audit

detections/application/splunk_xss_in_highlighted_json_events.yml

@@ -1,64 +0,0 @@
-name: Splunk XSS in Highlighted JSON Events
-id: 1030bc63-0b37-4ac9-9ae0-9361c955a3cc
-version: 3
-date: '2024-07-01'
-author: Rod Soto, Splunk
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: The following analytic identifies potential exploitation of a Cross-Site
-  Scripting (XSS) vulnerability in Splunk Enterprise 9.1.2. It detects suspicious
-  requests to the Splunk web GUI that may execute JavaScript within script tags. This
-  detection leverages logs from the `splunkd_ui` data source, focusing on specific
-  URI paths and HTTP methods. This activity is significant as it can allow attackers
-  to execute arbitrary JavaScript, potentially accessing the API with the logged-in
-  user's permissions. If the user is an admin, the attacker could create an admin
-  account, leading to full control over the Splunk environment.
-search: '`splunkd_ui` "/*/splunkd/__raw/servicesNS/nobody/search/authentication/users"
-  status=201 | stats count min(_time) as firstTime max(_time) as lastTime by clientip,
-  uri_path, method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `splunk_xss_in_highlighted_json_events_filter`'
-how_to_implement: This search only applies to web-GUI-enabled Splunk instances and
-  operator must have access to internal indexes.
-known_false_positives: This is a hunting search and will produce false positives as
-  it is not possible to view contents of a request payload. It shows the artifact
-  resulting from a potential exploitation payload (the creation of a user with admin
-  privileges).
-references:
-- https://advisory.splunk.com/advisories/SVD-2023-1103
-cve:
-- CVE-2023-46213
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  impact: 30
-  message: Possible XSS exploitation from $clientip$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 15
-  required_fields:
-  - clientip
-  - uri_path
-  - method
-  - status
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_highlighted_json_events_splunkd_ui_access.log
-    source: splunkd_ui_access.log
-    sourcetype: splunkd_ui_access
-    custom_index: _internal

detections/application/splunk_xss_in_monitoring_console.yml

@@ -1,60 +0,0 @@
-name: Splunk XSS in Monitoring Console
-id: b11accac-6fa3-4103-8a1a-7210f1a67087
-version: 2
-date: '2024-05-17'
-author: Lou Stella, Splunk
-status: experimental
-type: TTP
-description: The following analytic identifies attempts to exploit a reflective Cross-Site
-  Scripting (XSS) vulnerability in the Splunk Distributed Monitoring Console app.
-  It detects GET requests with suspicious query parameters by analyzing `splunkd_web`
-  logs in the _internal index. This activity is significant because it targets a known
-  vulnerability (CVE-2022-27183) that could allow attackers to execute arbitrary scripts
-  in the context of the user's browser. If confirmed malicious, this could lead to
-  unauthorized actions, data theft, or further compromise of the Splunk environment.
-data_source: []
-search: ' `splunkd_web` method="GET" uri_query="description=%3C*" | table _time host
-  status clientip user uri | `splunk_xss_in_monitoring_console_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The
-  detection does require the ability to search the _internal index. This detection
-  will find attempted exploitation of CVE-2022-27183.
-known_false_positives: Use of the monitoring console where the less-than sign (<)
-  is the first character in the description field.
-references:
-- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 80
-  cve:
-  - CVE-2022-27183
-  impact: 50
-  message: A potential XSS attempt has been detected from $user$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - method
-  - uri_query
-  - status
-  - clientip
-  - user
-  - uri
-  risk_score: 40
-  security_domain: threat
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/xss/splunk_web_access.log
-    source: /opt/splunk/var/log/splunk/web_access.log
-    sourcetype: splunk_web_access

detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml

@@ -1,67 +0,0 @@
-name: Splunk XSS in Save table dialog header in search page
-id: a974d1ee-ddca-4837-b6ad-d55a8a239c20
-version: 3
-date: '2024-07-01'
-author: Rod Soto
-status: production
-type: Hunting
-description: The following analytic identifies persistent cross-site scripting (XSS)
-  attempts in the 'Save Table' dialog on the Splunk search page. It detects POST requests
-  to the endpoint `/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model`
-  containing potential XSS payloads. This activity is significant because it can allow
-  a remote user with the "power" role to inject malicious scripts, leading to persistent
-  XSS vulnerabilities. If confirmed malicious, this could enable attackers to execute
-  arbitrary scripts in the context of the affected user, potentially leading to data
-  theft, session hijacking, or further exploitation within the Splunk environment.
-data_source:
-- Splunk
-search: '`splunkd_webx` method=POST  uri=/*/splunkd/__raw/servicesNS/nobody/search/datamodel/model
-  | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`'
-how_to_implement: Watch for POST requests combined with XSS script strings or obfuscation
-  against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model.
-known_false_positives: If host is vulnerable and XSS script strings are inputted they
-  will show up in search. Not all Post requests are malicious as they will show when
-  users create and save dashboards. This search may produce several results with non
-  malicious POST requests. Only affects Splunk Web enabled instances.
-references:
-- https://advisory.splunk.com/advisories/SVD-2022-1101
-- https://portswigger.net/web-security/cross-site-scripting
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2022-43561
-  impact: 50
-  message: Possible XSS exploitation attempt from $clientip$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - host
-  - _time
-  - status
-  - clientip
-  - user
-  - uri
-  - method
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_save_table_dialog_in_search_page.txt
-    source: /opt/splunk/var/log/splunk/web_access.log
-    sourcetype: splunk_web_access
-    custom_index: _internal
-    update_timestamp: true

detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml

@@ -1,72 +0,0 @@
-name: Splunk XSS Privilege Escalation via Custom Urls in Dashboard
-id: 01e1e386-7656-4f36-a55a-52fe39b04a96
-version: 1
-date: '2024-07-01'
-author: Rod Soto, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges. 
-search: '`splunkd_ui` method=POST /*/data/ui/views* 
-  | stats values(method) as method by _time index, sourcetype, host 
-  | eval event="post_request" 
-  | append 
-      [| search `audittrail` action="edit_user" operation="create" 
-      | rex field=_raw "object=\"(?<newUser>.*)\"" 
-      | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser 
-      | eval event="create_user"] 
-  | sort - _time 
-  | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m
-  | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount
-  | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`'
-how_to_implement: Requires access to internal indexes _audit and _internal.
-known_false_positives: This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime. 
-references:
-- https://advisory.splunk.com/
-cve:
-- CVE-2024-36992
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 50
-  impact: 10
-  kill_chain_phases:
-  - Exploitation
-  message: Possible XSS attack and privilege escalation via custom urls in dashboard against $host$
-  mitre_attack_id:
-  - T1189
-  nist:
-  - DE.CM
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - method
-  - host
-  - action
-  - operation
-  - splunk_server
-  - user
-  risk_score: 5
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_splunkd_ui_access_splunk_ui_access.log
-    source: /opt/splunk/var/log/splunk/splunkd_ui_access.log
-    sourcetype: splunkd_ui_access 
-    custom_index: _internal 
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_audittrail_audittrail.log
-    source: /opt/splunk/var/log/splunk/audittrail 
-    sourcetype: audittrail
-    custom_index: _audit 

detections/application/splunk_xss_via_external_urls_in_dashboards_ssrf.yml

@@ -1,60 +0,0 @@
-name: Splunk XSS Via External Urls in Dashboards SSRF
-id: b0a67520-ae82-4cf6-b04e-9f6cce56830d
-version: 1
-date: '2024-07-01'
-author: Rod Soto, Chase Franklin
-status: production
-type: Hunting
-data_source:
-- Splunk
-description: This is a hunting search that provides elements to find possible dashboards created with external URL references in order to elicit Server Side Request Forgery from /data/ui/views endpoint. 
-search: '`splunkd_web` user=* uri_path="/*/manager/permissions/launcher/data/ui/views/*" file=* 
-  | stats count min(_time) as firstTime max(_time) as lastTime by clientip user file host method uri_path uri_query
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `splunk_xss_via_external_urls_in_dashboards_ssrf_filter`'
-how_to_implement: Requires access to internal indexes.
-known_false_positives: This is a hunting search and requires an operator to search for specific indicators of Server Side Request Forgery attack against /data/ui/views. 
-  It is not possible to grab display the payloads of such requests, so this search provides users, ip addresses, requests, files, and queries that may indicate malicious intent. There will be false positives. 
-references:
-- https://advisory.splunk.com/SVD-2024-0714 
-cve:
-- CVE-2024-36994
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 50
-  impact: 10
-  kill_chain_phases:
-  - Exploitation
-  message: Possible SSRF attack from $clientip$
-  mitre_attack_id:
-  - T1189
-  nist:
-  - DE.CM
-  observable:
-  - name: clientip
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  required_fields:
-  - uri_path
-  - user 
-  - file 
-  - clientip 
-  risk_score: 5
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0714_web_access_splunk_web_access.log
-    source: /opt/splunk/var/log/splunk/web_access.log
-    sourcetype: splunk_web_access
-    custom_index: _internal

detections/application/splunk_xss_via_view.yml

@@ -1,63 +0,0 @@
-name: Splunk XSS via View
-id: 9ac2bfea-a234-4a18-9d37-6d747e85c2e4
-version: 2
-date: '2024-05-13'
-author: Rod Soto, Eric McGinnis, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies potential Cross-Site Scripting (XSS)
-  attempts via the 'layoutPanel' attribute in the 'module' tag within XML Views in
-  Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4. It leverages internal
-  logs from "splunk_web_service" and "splunk_python" sourcetypes, focusing on messages
-  containing "loadParams." This activity is significant as it can lead to unauthorized
-  script execution within the Splunk Web interface, potentially compromising the security
-  of the instance. If confirmed malicious, attackers could execute arbitrary scripts,
-  leading to data theft, session hijacking, or further exploitation of the Splunk
-  environment.
-data_source:
-- Splunk
-search: 'index = _internal sourcetype IN ("splunk_web_service", "splunk_python") message="*loadParams*"
-  | `security_content_ctime(_time)` |  table _time message fileName | `splunk_xss_via_view_filter`'
-how_to_implement: This data is collected by default in Splunk.  Upon first enabling
-  this rule, a number of errors may be observed. Those that are due to improperly
-  formatted, but non-nefarious, XML views should be be remedied in the corresponding
-  view. Please take care investigating potential XSS as accessing an affected page
-  could retrigger the exploit.
-known_false_positives: The error detected above can be generated for a wide variety
-  of improperly formatted XML views.  There will be false positives as the search
-  cannot extract the malicious payload and the view should be manually investigated.
-references:
-- https://www.splunk.com/en_us/product-security.html
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Endpoint
-  confidence: 50
-  cve:
-  - CVE-2023-22933
-  impact: 50
-  message: Potential stored XSS attempt via $fileName$
-  mitre_attack_id:
-  - T1189
-  observable:
-  - name: fileName
-    type: URL String
-    role:
-    - Target
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - message
-  - fileName
-  risk_score: 25
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log
-    source: /opt/splunk/var/log/splunk/web_service.log
-    sourcetype: splunk_web_service
-    custom_index: _internal

detections/deprecated/open_redirect_in_splunk_web.yml

@@ -1,36 +0,0 @@
-name: Open Redirect in Splunk Web
-id: d199fb99-2312-451a-9daa-e5efa6ed76a7
-version: 1
-date: '2017-09-19'
-author: Bhavin Patel, Splunk
-status: deprecated
-type: TTP
-description: This search allows you to look for evidence of exploitation for CVE-2016-4859,
-  the Splunk Open Redirect Vulnerability.
-data_source: []
-search: index=_internal sourcetype=splunk_web_access return_to="/%09/*" | `open_redirect_in_splunk_web_filter`
-how_to_implement: No extra steps needed to implement this search.
-known_false_positives: None identified
-references: []
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  confidence: 50
-  cve:
-  - CVE-2016-4859
-  impact: 50
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  risk_score: 25
-  security_domain: network

detections/deprecated/splunk_enterprise_information_disclosure.yml

@@ -1,43 +0,0 @@
-name: Splunk Enterprise Information Disclosure
-id: f6a26b7b-7e80-4963-a9a8-d836e7534ebd
-version: 1
-date: '2018-06-14'
-author: David Dorsey, Splunk
-status: deprecated
-type: TTP
-description: This search allows you to look for evidence of exploitation for CVE-2018-11409,
-  a Splunk Enterprise Information Disclosure Bug.
-data_source: []
-search: index=_internal sourcetype=splunkd_ui_access server-info | search clientip!=127.0.0.1
-  uri_path="*raw/services/server/info/server-info" | rename clientip as src_ip, splunk_server
-  as dest | stats earliest(_time) as firstTime, latest(_time) as lastTime, values(uri)
-  as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_information_disclosure_filter`
-how_to_implement: The REST endpoint that exposes system information is also necessary
-  for the proper operation of Splunk clustering and instrumentation. Whitelisting
-  your Splunk systems will reduce false positives.
-known_false_positives: Retrieving server information may be a legitimate API request.
-  Verify that the attempt is a valid request for information.
-references: []
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Splunk Server
-  confidence: 50
-  cve:
-  - CVE-2018-11409
-  impact: 50
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  risk_score: 25
-  security_domain: network

detections/endpoint/detect_renamed_psexec.yml

@@ -1,8 +1,8 @@
 name: Detect Renamed PSExec
 id: 683e6196-b8e8-11eb-9a79-acde48001122
-version: 5
-date: '2024-05-11'
-author: Michael Haag, Splunk
+version: 6
+date: '2024-07-23'
+author: Michael Haag, Splunk, Alex Oberkircher, Github Community
 status: production
 type: Hunting
 description: The following analytic identifies instances where `PsExec.exe` has been
@@ -16,7 +16,7 @@ data_source:
 - Sysmon EventID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!=psexec.exe
-  OR Processes.process_name!=psexec64.exe) AND Processes.original_file_name=psexec.c
+  AND Processes.process_name!=psexec64.exe) AND Processes.original_file_name=psexec.c
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

detections/endpoint/disable_logs_using_wevtutil.yml

@@ -1,7 +1,7 @@
 name: Disable Logs Using WevtUtil
 id: 236e7c8e-c9d9-11eb-a824-acde48001122
-version: 2
-date: '2024-05-13'
+version: 3
+date: '2024-07-23'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -41,7 +41,7 @@ tags:
   asset_type: Endpoint
   confidence: 80
   impact: 30
-  message: WevtUtil.exe used to disable Event Logging on $dest
+  message: WevtUtil.exe used to disable Event Logging on $dest$
   mitre_attack_id:
   - T1070
   - T1070.001
@@ -73,3 +73,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -1,7 +1,7 @@
 name: Disable Windows Behavior Monitoring
 id: 79439cae-9200-11eb-a4d3-acde48001122
-version: 6
-date: '2024-05-18'
+version: 7
+date: '2024-07-23'
 author: Steven Dick, Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -48,7 +48,7 @@ tags:
   asset_type: Endpoint
   confidence: 100
   impact: 40
-  message: Windows Defender real time behavior monitoring disabled on $dest
+  message: Windows Defender real time behavior monitoring disabled on $dest$
   mitre_attack_id:
   - T1562.001
   - T1562
@@ -78,3 +78,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -23,7 +23,7 @@ search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.e
 how_to_implement: To successfully implement this search, you must ingest Windows Security
   Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
   Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: other browser not listed related to firefox may catch by this
+known_false_positives: other browser not listed related to chrome may catch by this
   rule.
 references: []
 tags:

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml

@@ -1,7 +1,7 @@
 name: Remote Process Instantiation via DCOM and PowerShell
 id: d4f42098-4680-11ec-ad07-3e22fbd008af
-version: 2
-date: '2024-05-20'
+version: 3
+date: '2024-07-23'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -42,7 +42,7 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 90
-  message: A process was started on a remote endpoint from $dest by abusing DCOM using
+  message: A process was started on a remote endpoint from $dest$ by abusing DCOM using
     PowerShell.exe
   mitre_attack_id:
   - T1021
@@ -78,3 +78,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml

@@ -1,7 +1,7 @@
 name: Remote Process Instantiation via WinRM and PowerShell
 id: ba24cda8-4716-11ec-8009-3e22fbd008af
-version: 2
-date: '2024-05-14'
+version: 3
+date: '2024-07-23'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -42,7 +42,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 90
-  message: A process was started on a remote endpoint from $dest by abusing WinRM
+  message: A process was started on a remote endpoint from $dest$ by abusing WinRM
     using PowerShell.exe
   mitre_attack_id:
   - T1021
@@ -78,3 +78,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml

@@ -1,7 +1,7 @@
 name: Remote Process Instantiation via WinRM and Winrs
 id: 0dd296a2-4338-11ec-ba02-3e22fbd008af
-version: 2
-date: '2024-05-16'
+version: 3
+date: '2024-07-23'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -42,7 +42,7 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 90
-  message: A process was started on a remote endpoint from $dest
+  message: A process was started on a remote endpoint from $dest$
   mitre_attack_id:
   - T1021
   - T1021.006
@@ -77,3 +77,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml

@@ -1,7 +1,7 @@
 name: Scheduled Task Creation on Remote Endpoint using At
 id: 4be54858-432f-11ec-8209-3e22fbd008af
-version: 2
-date: '2024-05-24'
+version: 3
+date: '2024-07-23'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -43,7 +43,7 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 90
-  message: A Windows Scheduled Task was created on a remote endpoint from $dest
+  message: A Windows Scheduled Task was created on a remote endpoint from $dest$
   mitre_attack_id:
   - T1053
   - T1053.002
@@ -78,3 +78,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml

@@ -1,8 +1,8 @@
 name: Scheduled Task Initiation on Remote Endpoint
 id: 95cf4608-4302-11ec-8194-3e22fbd008af
-version: 2
-date: '2024-05-25'
-author: Mauricio Velazco, Splunk
+version: 4
+date: '2024-07-23'
+author: Mauricio Velazco, Splunk, Badoodish, Github Community
 status: production
 type: TTP
 description: The following analytic detects the use of 'schtasks.exe' to start a Scheduled
@@ -16,7 +16,7 @@ data_source:
 - Sysmon EventID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe
-  OR Processes.original_file_name=schtasks.exe) (Processes.process=*/s* AND Processes.process=*/run*)
+  OR Processes.original_file_name=schtasks.exe) (Processes.process= "* /S *" AND Processes.process=*/run*)
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`'
@@ -42,7 +42,7 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 90
-  message: A Windows Scheduled Task was ran on a remote endpoint from $dest
+  message: A Windows Scheduled Task was ran on a remote endpoint from $dest$
   mitre_attack_id:
   - T1053
   - T1053.005
@@ -77,3 +77,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/endpoint/windows_ad_domain_replication_acl_addition.yml

@@ -14,11 +14,11 @@ description: The following analytic detects the addition of permissions required
   attack, which can be used to replicate AD objects and exfiltrate sensitive data.
   If confirmed malicious, an attacker could gain extensive access to Active Directory,
   leading to severe data breaches and privilege escalation.
-search: '`wineventlog_security`  | rex field=AttributeValue max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?P<DSRGetChangesFiltered_user_sid>S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)\"|
+search: '`wineventlog_security`  | rex field=AttributeValue max_match=10000 "OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?P<DSRGetChangesFiltered_user_sid>S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)"|
   table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid|
-  mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"true\",\"false\"),
-  fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")|
-  where minDCSyncPermissions=\"true\" | lookup identity_lookup_expanded  objectSid
+  mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,"true","false"),
+  fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,"true","false")|
+  where minDCSyncPermissions="true" | lookup identity_lookup_expanded  objectSid
   as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid
   as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid
   minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`'

detections/endpoint/windows_new_inprocserver32_added.yml

@@ -1,7 +1,7 @@
 name: Windows New InProcServer32 Added
 id: 0fa86e31-0f73-4ec7-9ca3-dc88e117f1db
-version: 2
-date: '2024-05-13'
+version: 3
+date: '2024-07-23'
 author: Michael Haag, Splunk
 data_source:
 - Sysmon EventID 13
@@ -57,7 +57,7 @@ tags:
   risk_score: 2
   security_domain: endpoint
   cve:
-  - cve-2024-21378
+  - CVE-2024-21378
 tests:
 - name: True Positive Test
   attack_data:
@@ -65,3 +65,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log
     sourcetype: xmlwineventlog
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+# version bumped by pre-commit hook

detections/endpoint/windows_service_creation_on_remote_endpoint.yml

@@ -1,7 +1,7 @@
 name: Windows Service Creation on Remote Endpoint
 id: e0eea4fa-4274-11ec-882b-3e22fbd008af
-version: 2
-date: '2024-05-21'
+version: 3
+date: '2024-07-23'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -44,7 +44,7 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 90
-  message: A Windows Service was created on a remote endpoint from $dest
+  message: A Windows Service was created on a remote endpoint from $dest$
   mitre_attack_id:
   - T1543
   - T1543.003
@@ -79,3 +79,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/endpoint/windows_service_initiation_on_remote_endpoint.yml

@@ -1,7 +1,7 @@
 name: Windows Service Initiation on Remote Endpoint
 id: 3f519894-4276-11ec-ab02-3e22fbd008af
-version: 2
-date: '2024-05-10'
+version: 3
+date: '2024-07-23'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -41,7 +41,7 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 90
-  message: A Windows Service was started on a remote endpoint from $dest
+  message: A Windows Service was started on a remote endpoint from $dest$
   mitre_attack_id:
   - T1543
   - T1543.003
@@ -76,3 +76,4 @@ tests:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+# version bumped by pre-commit hook

detections/network/splunk_identified_ssl_tls_certificates.yml

@@ -1,71 +0,0 @@
-name: Splunk Identified SSL TLS Certificates
-id: 620fbb89-86fd-4e2e-925f-738374277586
-version: 2
-date: '2024-05-23'
-author: Michael Haag, Splunk
-status: production
-type: Hunting
-description: The following analytic identifies the usage of Splunk default SSL/TLS
-  certificates within the environment. It leverages tags such as SSL, TLS, and certificate
-  to detect these default certificates by examining the ssl_issuer_common_name field.
-  This activity is significant because using default certificates can expose the environment
-  to potential security risks, as they are not unique and can be easily exploited.
-  If confirmed malicious, attackers could intercept or manipulate data, leading to
-  unauthorized access or data breaches. It is recommended to replace default certificates
-  with valid, unique TLS certificates to enhance security.
-data_source:
-- Splunk Stream TCP
-search: tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src)
-  AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization
-  ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`
-how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as
-  ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams.
-  Splunk SOAR customers can find a SOAR workbook that walks an analyst through the
-  process of running these hunting searches in the references list of this detection.
-  In order to use this workbook, a user will need to run a curl command to post the
-  file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template
-  -d @splunk_psa_0622.json". A user should then create an empty container or case,
-  attach the workbook, and begin working through the tasks.
-known_false_positives: False positives will not be present as it is meant to assist
-  with identifying default certificates being utilized.
-references:
-- https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL
-- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Proxy
-  confidence: 70
-  cve:
-  - CVE-2022-32151
-  - CVE-2022-32152
-  impact: 60
-  message: The following $host$ is using the self signed Splunk certificate.
-  mitre_attack_id:
-  - T1040
-  observable:
-  - name: host
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - ssl_issuer
-  - ssl_subject_common_name
-  - ssl_subject_organization
-  - ssl_subject
-  - host
-  - sourcetype
-  risk_score: 42
-  security_domain: network
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log
-    source: stream:tcp
-    sourcetype: stream:tcp
-    update_timestamp: true

dist/DA-ESS-ContentUpdate/README.md

@@ -1,7 +0,0 @@
-# Splunk ES Content Update
-
-This subscription service delivers pre-packaged Security Content for use with Splunk Enterprise Security. Subscribers get regular updates to help security practitioners more quickly address ongoing and time-sensitive customer problems and threats.
-
-Requires Splunk Enterprise Security version 4.5 or greater.
-
-For more information please visit the [Splunk ES Content Update user documentation](https://docs.splunk.com/Documentation/ESSOC).

dist/DA-ESS-ContentUpdate/README/essoc_story_detail.txt

@@ -1,15 +0,0 @@
-The Analytic Story Details dashboard renders all the details of the content related to a specific analytic story which
-can be chose via the drop down
-
-Each analytic story has attributes associated with it and the following:
-______________________________________________________________________
-
-
-	Analytic Story: name of the analytic story
-	Description	; description of the analytic story
-	Search Name	: The name of the searches belonging to the chosen analytic story
-	Search	: The search query which looks for an attack pattern corresponding to the analytic story
-	Search Description: The description of the search query
-	Asset Type: The analytic story specifies what asset in the infrastructure may be compromised
-	Category: The category that the search belongs to (malware, vulnerabilities, best practices, abuse)
-	Kill Chain Phase: The kill chain phase of the attack that the search is after.

dist/DA-ESS-ContentUpdate/README/essoc_summary.txt

@@ -1,24 +0,0 @@
-The ES_SOC Summary Dashboard provides you a summarized view of the analytic story contents of the ES-SOC app.
-The dashboard has the following panels gives you following details
-
-1) Analytic story Summary
- 	- Total Analytic Stories : The total number of Analytic stories in the ES-SOC application
- 	- Total Searches: The total number of searches in ES-SOC
- 	- Searches added last week: Number of searches added to ES-SOC in the last week.
-
- 2) Analytic story Category: This dashboard panel summarizes the categories of the searches that the ES-SOC app contains. The categories of the analytic stories are as follow
-  	-Malware: These searches detect specific malware behavior for a particular phase of the attack kill chain. E.g. a malware’s delivery method via email or a malware’s installation behavior via registry key changes
-  	-Vulnerability: These searches detect behavior or a signature of a vulnerable software in use. These searches are not designed to replace vulnerability management or scanning systems. The purpose of these searches is to discover a vulnerability through side effects or behaviors.
-  	-Abuse: Some actions can be deemed malicious because they are unexpected, violate corporate policy or are significantly different than the actions of other users. E.g. A USB disk that is seen on multiple systems or a user that uploads excessive files to a cloud service or a database query that dumps an entire table
-  	-Best Practices:  Searches that correspond to specific guidelines from organizations like SANS or OWASP
-
- 3) Kill Chain phases: Every analytic story has one or more searches which look for a certain kind of attack pattern/behavior. These searches have an attribute which essentially tells you what Kill chain phase does the search correspond to.
-    The numbers on the dashboard represents the number of searches correponding to each kill chain phase
-
- 4) Analytic story table: This table gives the user a comprehensive view of some of the details of the analytic story. Some of the listed attributes are:
-  	- Analytic Story : The name of the analytic story
-  	- Description: The description of the analyttic story
-  	- Search names: The name of the searches in each analytic story
-  	- Datamodels: The name of the datamodel that the search is querying against.
-  	- Technology Examples: This field represent some examples related to the technologies required to populate the datamodels(Nessues, Cisco Firewall,etc)
-  	- Kill chain phase: The name of the kill chain phase that the search belongs to

dist/DA-ESS-ContentUpdate/README/essoc_usage_dashboard.txt

@@ -1,51 +0,0 @@
-######################
-ESSOC Usage Dashboard#
-######################
-
-The ESSOC Usage dashboard is designed to provide high-level insight into the usage of the ES-SOC app. It is suitable for display when providing feedback to the Splunk team or for identifying how the ES-SOC app is being used. This dashboard has two time selectors that work independently - the top time selector determines the search time range for all the single-value. And the lower time selector, determines the time range for the usage table.
-
-IMPORTANT: The user loading this dashboard must have permission to search the _audit index
-
-##################
-#Dashboard panels#
-##################
-
-Searches Ran
-
-The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax
-
-Unique Searches
-
-The unique/distinct searches executed on the deployment. This is equivalent to the distinct count of searches run in the ES-SOC app.
-
-Most Run
-
-The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
-
-Ad hoc Searches
-
-The total number of searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
-
-Scheduled
-
-The total number of ESSOC searches run that were scheduled.
-
-Most Active User
-
-The user who executed the highest number/count of searches. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
-
-Search Run Time (seconds)
-
-Total run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
-
-Average Run Time (seconds)
-
-Average run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
-
-Max Run Time (seconds)
-
-The run time of the longest running search. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
-
-Search summary
-
-This table provides details on each search that was executed in the ESSOC app.

dist/DA-ESS-ContentUpdate/app.manifest

@@ -1,46 +0,0 @@
-{
-  "schemaVersion": "1.0.0", 
-  "info": {
-    "title": "ES Content Updates", 
-    "id": {
-      "group": null, 
-      "name": "DA-ESS-ContentUpdate", 
-      "version": "4.35.0"
-    }, 
-    "author": [
-      {
-        "name": "Splunk Threat Research Team", 
-        "email": "research@splunk.com", 
-        "company": "Splunk"
-      }
-    ], 
-    "releaseDate": "2024-07-09", 
-    "description": "Explore the Analytic Stories included with ES Content Updates.", 
-    "classification": {
-      "intendedAudience": null, 
-      "categories": [], 
-      "developmentStatus": null
-    }, 
-    "commonInformationModels": null, 
-    "license": {
-      "name": null, 
-      "text": null, 
-      "uri": null
-    }, 
-    "privacyPolicy": {
-      "name": null, 
-      "text": null, 
-      "uri": null
-    }, 
-    "releaseNotes": {
-      "name": null, 
-      "text": "./README.md", 
-      "uri": null
-    }
-  }, 
-  "dependencies": null, 
-  "tasks": null, 
-  "inputGroups": null, 
-  "incompatibleApps": null, 
-  "platformRequirements": null
-}

dist/DA-ESS-ContentUpdate/default/analytic_stories.conf

@@ -1,2 +0,0 @@
-### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
-### Using one single file analyticstories.conf that will be used both by ES and ESCU 

dist/DA-ESS-ContentUpdate/default/app.conf

@@ -1,41 +0,0 @@
-#############
-# Automatically generated by 'contentctl build' from 
-# https://github.com/splunk/contentctl
-# On Date: 2024-07-09T00:27:47 UTC
-# Author: Splunk Threat Research Team - Splunk
-# Contact: research@splunk.com
-#############
-## Splunk app configuration file
-
-[install]
-is_configured = false
-state = enabled
-state_change_requires_restart = false
-build = 20240709002745
-
-[triggers]
-reload.analytic_stories = simple
-reload.usage_searches = simple
-reload.use_case_library = simple
-reload.correlationsearches = simple
-reload.analyticstories = simple
-reload.governance = simple
-reload.managed_configurations = simple
-reload.postprocess = simple
-reload.content-version = simple
-reload.es_investigations = simple
-
-[launcher]
-author = Splunk
-version = 4.35.0 
-description = Explore the Analytic Stories included with ES Content Updates.
-
-[ui]
-is_visible = true
-label = ES Content Updates
-
-[package]
-id = DA-ESS-ContentUpdate
-
-
-

dist/DA-ESS-ContentUpdate/default/collections.conf

@@ -1,100 +0,0 @@
-#############
-# Automatically generated by 'contentctl build' from 
-# https://github.com/splunk/contentctl
-# On Date: 2024-07-09T00:27:47 UTC
-# Author: Splunk Threat Research Team - Splunk
-# Contact: research@splunk.com
-#############
-
-[api_call_by_user_baseline]
-enforceTypes = false
-replicate = false
-
-[cloud_instances_enough_data]
-enforceTypes = false
-replicate = false
-
-[k8s_container_network_io_baseline]
-enforceTypes = false
-replicate = false
-
-[k8s_container_network_io_ratio_baseline]
-enforceTypes = false
-replicate = false
-
-[k8s_process_resource_baseline]
-enforceTypes = false
-replicate = false
-
-[k8s_process_resource_ratio_baseline]
-enforceTypes = false
-replicate = false
-
-[previously_seen_api_calls_from_user_roles]
-enforceTypes = false
-replicate = false
-
-[previously_seen_aws_cross_account_activity]
-enforceTypes = false
-replicate = false
-
-[previously_seen_aws_regions]
-enforceTypes = false
-replicate = false
-
-[previously_seen_cloud_api_calls_per_user_role]
-enforceTypes = false
-replicate = false
-
-[previously_seen_cloud_compute_creations_by_user]
-enforceTypes = false
-replicate = false
-
-[previously_seen_cloud_compute_images]
-enforceTypes = false
-replicate = false
-
-[previously_seen_cloud_compute_instance_types]
-enforceTypes = false
-replicate = false
-
-[previously_seen_cloud_instance_modifications_by_user]
-enforceTypes = false
-replicate = false
-
-[previously_seen_cloud_provisioning_activity_sources]
-enforceTypes = false
-replicate = false
-
-[previously_seen_cloud_regions]
-enforceTypes = false
-replicate = false
-
-[previously_seen_gcp_storage_access_from_remote_ip]
-enforceTypes = false
-replicate = false
-
-[previously_seen_running_windows_services]
-enforceTypes = false
-replicate = false
-
-[previously_seen_S3_access_from_remote_ip]
-enforceTypes = false
-replicate = false
-
-[previously_seen_users_console_logins]
-enforceTypes = false
-replicate = false
-
-[s3_deletion_baseline]
-enforceTypes = false
-replicate = false
-
-[security_group_activity_baseline]
-enforceTypes = false
-replicate = false
-
-[zoom_first_time_child_process]
-enforceTypes = false
-replicate = false
-