Branch was auto-updated.

.gitignore

@@ -117,8 +117,8 @@ package/default/sftp-config.json
 notes
 
 # detection_testing_batch innteractive mode
-bin/automated_detection_testing/ci/detection_testing_batch/*-test-run.json
-bin/automated_detection_testing/ci/detection_testing_batch/apps/
-bin/automated_detection_testing/ci/detection_testing_batch/security_content/
-bin/automated_detection_testing/ci/detection_testing_batch/test_config.json
-bin/automated_detection_testing/ci/detection_testing_batch/test_results/
+bin/docker_detection_tester/*-test-run.json
+bin/docker_detection_tester/apps/
+bin/docker_detection_tester/security_content/
+bin/docker_detection_tester/test_config.json
+bin/docker_detection_tester/test_results/

detections/endpoint/java_writing_jsp_file.yml

@@ -0,0 +1,88 @@
+name: Java Writing JSP File
+id: eb65619c-4f8d-4383-a975-d352765d344b
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe")
+  by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
+  Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
+  `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where
+  Filesystem.file_name="*.jsp*" by _time Filesystem.dest Filesystem.file_create_time
+  Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user
+  | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
+  file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
+  as lastTime by dest process_name process_guid file_name file_path file_create_time
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_writing_jsp_file_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment.
+references:
+- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
+- https://github.com/TheGejr/SpringShell
+- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22965
+  cve:
+  - CVE-2022-22965
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $process_name$ was identified
+    on endpoint $dest$ writing a jsp file to disk, potentially indicative of exploitation.
+  mitre_attack_id:
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Filesystem.dest 
+  - Filesystem.file_create_time
+  - Filesystem.file_name 
+  - Filesystem.file_path 
+  - Filesystem.process_guid 
+  - Filesystem.user
+  risk_score: 42
+  security_domain: endpoint

detections/endpoint/linux_java_spawning_shell.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Hermetic Wiper
   - Log4Shell CVE-2021-44228
+  - Spring4Shell CVE-2022-22965
   asset_type: Endpoint
   confidence: 50
   context:

detections/web/spring4shell_payload_url_request.yml

@@ -0,0 +1,72 @@
+name: Spring4Shell Payload URL Request
+id: 2850c734-2d44-4431-8139-1a56f6f54c01
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. 
+  The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
+search: '| tstats count from datamodel=Web where Web.http_method IN ("GET")
+  Web.url IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*")
+  by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest
+  sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `spring4shell_payload_url_request_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. 
+known_false_positives: The jsp file names are static names used in current proof of concept code. =
+references:
+- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
+- https://github.com/TheGejr/SpringShell
+- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22965
+  cve:
+  - CVE-2022-22965
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A URL was requested related to Spring4Shell POC code on $dest$ by $src$.
+  mitre_attack_id:
+  - T1505.003
+  - T1505
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: IP Address
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  risk_score: 36
+  security_domain: network

detections/web/web_jsp_request_via_url.yml

@@ -0,0 +1,72 @@
+name: Web JSP Request via URL
+id: 2850c734-2d44-4431-8139-1a56f6f54c01
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic identifies the common URL requests used by a recent CVE - CVE-2022-22965, or Spring4Shell, to access a webshell on the remote webserver.
+  The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
+search: '| tstats count from datamodel=Web where Web.http_method IN ("GET")
+  Web.url IN ("*.jsp?cmd=*","*j&cmd=*")
+  by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest
+  sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `web_jsp_request_via_url_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. 
+known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
+references:
+- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
+- https://github.com/TheGejr/SpringShell
+- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22965
+  cve:
+  - CVE-2022-22965
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A suspicious URL has been requested against $dest$ by $src$, related to web shell activity.
+  mitre_attack_id:
+  - T1505.003
+  - T1505
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  risk_score: 72
+  security_domain: network

detections/web/web_spring4shell_http_request_class_module.yml

@@ -0,0 +1,70 @@
+name: Web Spring4Shell HTTP Request Class Module
+id: fcdfd69d-0ca3-4476-920e-9b633cb4593e
+version: 1
+date: '2022-04-06'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic identifies the payload related to Spring4Shell, CVE-2022-22965. This analytic uses Splunk Stream HTTP to view the http request body, form data. STRT reviewed all the current proof of concept code and determined the commonality with the payloads being passed used the same fields "class.module.classLoader.resources.context.parent.pipeline.first".
+search: '`stream_http` http_method IN ("POST")
+  | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out
+  | search http_request_body IN ("*class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=_*", "*class.module.classLoader.resources.context.parent.pipeline.first.pattern*","*suffix=.jsp*")
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `web_spring4shell_http_request_class_module_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the stream HTTP logs or network logs that catch network traffic. Make
+  sure that the http-request-body, payload, or request field is enabled.
+known_false_positives: False positives may occur and filtering may be required. Restrict analytic to asset type.
+references:
+- https://github.com/DDuarte/springshell-rce-poc/blob/master/poc.py
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22965
+  cve:
+  - CVE-2022-22965
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/http_request_body_streams.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A http body request related to Spring4Shell has been sent to $dest$ by $src$.
+  mitre_attack_id:
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - http_request_body
+  - http_method
+  - http_user_agent
+  - uri_path 
+  - url 
+  - bytes_in 
+  - bytes_out
+  risk_score: 72
+  security_domain: network
+
+

detections/web/web_spring_cloud_function_functionrouter.yml

@@ -0,0 +1,69 @@
+name: Web Spring Cloud Function FunctionRouter
+id: 89dddbad-369a-4f8a-ace2-2439218735bc
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic identifies activity related to the web application Spring Cloud Function that was recently idenfied as vulnerable. This is CVE-2022-22963.
+  Multiple proof of concept code was released. 
+  The URI that is hit includes `functionrouter`. The specifics of the exploit include a status of 500. In this query we did not include it, but for filtering you can add Web.status=500.
+  The exploit data itself (based on all the POCs) is located in the form_data field. This field will include all class.modules being called.
+search: '| tstats count from datamodel=Web where Web.http_method IN ("POST") Web.url="*/functionRouter*"
+  by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.status sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `web_spring_cloud_function_functionrouter_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. 
+known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
+references:
+- https://github.com/rapid7/metasploit-framework/pull/16395
+- https://github.com/hktalent/spring-spel-0day-poc
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22965
+  cve:
+  - CVE-2022-22963
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/all_functionrouter_http_streams.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud.
+  mitre_attack_id:
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  risk_score: 42
+  security_domain: network

stories/spring4shell_cve_2022_22965.yml

@@ -0,0 +1,30 @@
+name: Spring4Shell CVE-2022-22965
+id: dcc19913-6918-4ed2-bbba-a6b484c10ef4
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+description: Spring4Shell is the nickname given to a zero-day vulnerability in the Spring Core Framework, a programming and configuration model for Java-based enterprise applications.
+narrative: 'An attacker could exploit Spring4Shell by sending a specially crafted request to a vulnerable server. However, exploitation of Spring4Shell requires certain prerequisites, whereas the original Log4Shell vulnerability affected all versions of Log4j 2 using the default configuration. \
+
+According to Spring, the following requirements were included in the vulnerability report, however the post cautions that there may be other ways in which this can be exploited so this may not be a complete list of requirements at this time: \
+
+- Java Development Kit (JDK) 9 or greater \
+
+- Apache Tomcat as the Servlet container \
+
+- Packaged as a WAR \
+
+- spring-webmvc or spring-webflux dependency \
+
+'
+references:
+- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
+tags:
+  analytic_story: Spring4Shell CVE-2022-22965
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Application Security

tests/endpoint/java_writing_jsp_file.test.yml

@@ -0,0 +1,12 @@
+name: Java Writing JSP File Unit Test
+tests:
+- name: Java Writing JSP File
+  file: endpoint/java_writing_jsp_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: java_write_jsp-linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/web/spring4shell_payload_url_request.test.yml

@@ -0,0 +1,12 @@
+name: Spring4Shell Payload URL Request Unit Test
+tests:
+- name: Spring4Shell Payload URL Request
+  file: web/spring4shell_payload_url_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: spring4shell_nginx.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log
+    source: /var/log/nginx/access.log
+    sourcetype: nginx:plus:kv

tests/web/web_jsp_request_via_url.test.yml

@@ -0,0 +1,12 @@
+name: Web JSP Request via URL Unit Test
+tests:
+- name: Web JSP Request via URL
+  file: web/web_jsp_request_via_url.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: spring4shell_nginx.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log
+    source: /var/log/nginx/access.log
+    sourcetype: nginx:plus:kv

tests/web/web_spring4shell_http_request_class_module.test.yml

@@ -0,0 +1,12 @@
+name: Web Spring4Shell HTTP Request Class Module Unit Test
+tests:
+- name: Web Spring4Shell HTTP Request Class Module
+  file: web/web_spring4shell_http_request_class_module.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: http_request_body_streams.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/http_request_body_streams.log
+    source: stream:http
+    sourcetype: stream:http

tests/web/web_spring_cloud_function_functionrouter.test.yml

@@ -0,0 +1,12 @@
+name: Web Spring Cloud Function FunctionRouter Unit Test
+tests:
+- name: Web Spring Cloud Function FunctionRouter
+  file: web/web_spring_cloud_function_functionrouter.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: all_functionrouter_http_streams.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/all_functionrouter_http_streams.log
+    source: stream:http
+    sourcetype: stream:http