From 6ebca1861497b12c9dec31587d54a9945b5d4911 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 5 Apr 2022 11:53:23 -0600
Subject: [PATCH 1/9] Spring4Shell

---
 .../web/spring4shell_payload_url_request.yml  | 72 ++++++++++++++++++
 detections/web/web_jsp_request_via_url.yml    | 74 +++++++++++++++++++
 stories/spring4shell_cve_2022_22963.yml       | 30 ++++++++
 .../spring4shell_payload_url_request.test.yml | 12 +++
 tests/web/web_jsp_injection_via_url.test.yml  | 12 +++
 5 files changed, 200 insertions(+)
 create mode 100644 detections/web/spring4shell_payload_url_request.yml
 create mode 100644 detections/web/web_jsp_request_via_url.yml
 create mode 100644 stories/spring4shell_cve_2022_22963.yml
 create mode 100644 tests/web/spring4shell_payload_url_request.test.yml
 create mode 100644 tests/web/web_jsp_injection_via_url.test.yml

diff --git a/detections/web/spring4shell_payload_url_request.yml b/detections/web/spring4shell_payload_url_request.yml
new file mode 100644
index 0000000000..9b8ec01232
--- /dev/null
+++ b/detections/web/spring4shell_payload_url_request.yml
@@ -0,0 +1,72 @@
+name: Spring4Shell Payload URL Request
+id: 2850c734-2d44-4431-8139-1a56f6f54c01
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. 
+  The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
+search: '| tstats count from datamodel=Web where Web.http_method IN ("GET")
+  Web.url IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*")
+  by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest
+  sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `spring4shell_payload_url_request_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. 
+known_false_positives: The jsp file names are static names used in current proof of concept code. =
+references:
+- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
+- https://github.com/TheGejr/SpringShell
+- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22963
+  cve:
+  - CVE-2022-22963
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A URL was requested related to Spring4Shell POC code on $dest$ by $src$.
+  mitre_attack_id:
+  - T1505.003
+  - T1505
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: Other
+    role:
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  risk_score: 36
+  security_domain: network
diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml
new file mode 100644
index 0000000000..66c087b061
--- /dev/null
+++ b/detections/web/web_jsp_request_via_url.yml
@@ -0,0 +1,74 @@
+name: Web JSP Request via URL
+id: 2850c734-2d44-4431-8139-1a56f6f54c01
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic identifies the common URL requests used by a recent CVE - CVE-2022-22963, or Spring4Shell, to access a webshell on the remote webserver.
+  The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
+search: '| tstats count from datamodel=Web where Web.http_method IN ("GET")
+  Web.url IN ("*.jsp?cmd=*","*j&cmd=*")
+  by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest
+  sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `web_jsp_request_via_url_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. 
+known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
+references:
+- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
+- https://github.com/TheGejr/SpringShell
+- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22963
+  cve:
+  - CVE-2022-22963
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A suspicious URL has been requested against $dest$ by $src$, related to web shell activity.
+  mitre_attack_id:
+  - T1505.003
+  - T1505
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: Other
+    role:
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  risk_score: 72
+  security_domain: network
+
+
diff --git a/stories/spring4shell_cve_2022_22963.yml b/stories/spring4shell_cve_2022_22963.yml
new file mode 100644
index 0000000000..cfbaf147ce
--- /dev/null
+++ b/stories/spring4shell_cve_2022_22963.yml
@@ -0,0 +1,30 @@
+name: Spring4Shell CVE-2022-22963
+id: dcc19913-6918-4ed2-bbba-a6b484c10ef4
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+description: Spring4Shell is the nickname given to a zero-day vulnerability in the Spring Core Framework, a programming and configuration model for Java-based enterprise applications.
+narrative: 'An attacker could exploit Spring4Shell by sending a specially crafted request to a vulnerable server. However, exploitation of Spring4Shell requires certain prerequisites, whereas the original Log4Shell vulnerability affected all versions of Log4j 2 using the default configuration. \
+
+According to Spring, the following requirements were included in the vulnerability report, however the post cautions that there may be other ways in which this can be exploited so this may not be a complete list of requirements at this time: \
+
+- Java Development Kit (JDK) 9 or greater \
+
+- Apache Tomcat as the Servlet container \
+
+- Packaged as a WAR \
+
+- spring-webmvc or spring-webflux dependency \
+
+'
+references:
+- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
+tags:
+  analytic_story: Spring4Shell CVE-2022-22963
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Application Security
diff --git a/tests/web/spring4shell_payload_url_request.test.yml b/tests/web/spring4shell_payload_url_request.test.yml
new file mode 100644
index 0000000000..31c425d39c
--- /dev/null
+++ b/tests/web/spring4shell_payload_url_request.test.yml
@@ -0,0 +1,12 @@
+name: Spring4Shell Payload URL Request Unit Test
+tests:
+- name: Spring4Shell Payload URL Request
+  file: web/spring4shell_payload_url_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: spring4shell_nginx.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log
+    source: /var/log/nginx/access.log
+    sourcetype: nginx:plus:kv
\ No newline at end of file
diff --git a/tests/web/web_jsp_injection_via_url.test.yml b/tests/web/web_jsp_injection_via_url.test.yml
new file mode 100644
index 0000000000..e9659c4210
--- /dev/null
+++ b/tests/web/web_jsp_injection_via_url.test.yml
@@ -0,0 +1,12 @@
+name: Web JSP Request via URL Unit Test
+tests:
+- name: Web JSP Injection via URL
+  file: web/web_jsp_request_via_url.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: spring4shell_nginx.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log
+    source: /var/log/nginx/access.log
+    sourcetype: nginx:plus:kv

From 0da666fc1007bedb918b52f4abfcd50089819061 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 5 Apr 2022 12:38:53 -0600
Subject: [PATCH 2/9] nix write jsp

---
 .../endpoint/linux_java_spawning_shell.yml    |  1 +
 .../endpoint/linux_java_writing_jsp_file.yml  | 88 +++++++++++++++++++
 .../linux_java_writing_jsp_file.test.yml      | 12 +++
 3 files changed, 101 insertions(+)
 create mode 100644 detections/endpoint/linux_java_writing_jsp_file.yml
 create mode 100644 tests/endpoint/linux_java_writing_jsp_file.test.yml

diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml
index 2e91f5290d..7b6d7045b1 100644
--- a/detections/endpoint/linux_java_spawning_shell.yml
+++ b/detections/endpoint/linux_java_spawning_shell.yml
@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
+  - Spring4Shell CVE-2022-22963
   asset_type: Endpoint
   confidence: 50
   context:
diff --git a/detections/endpoint/linux_java_writing_jsp_file.yml b/detections/endpoint/linux_java_writing_jsp_file.yml
new file mode 100644
index 0000000000..255bbefac4
--- /dev/null
+++ b/detections/endpoint/linux_java_writing_jsp_file.yml
@@ -0,0 +1,88 @@
+name: Linux Java Writing JSP File
+id: eb65619c-4f8d-4383-a975-d352765d344b
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=java
+  by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
+  Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
+  `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where
+  Filesystem.file_name="*.jsp" by _time Filesystem.dest Filesystem.file_create_time
+  Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user
+  | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
+  file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
+  as lastTime by dest process_name process_guid file_name file_path file_create_time
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_writing_jsp_file_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment.
+references:
+- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
+- https://github.com/TheGejr/SpringShell
+- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22963
+  cve:
+  - CVE-2022-22963
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $process_name$ was identified
+    on endpoint $dest$ writing a jsp file to disk, potentially indicative of exploitation.
+  mitre_attack_id:
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Filesystem.dest 
+  - Filesystem.file_create_time
+  - Filesystem.file_name 
+  - Filesystem.file_path 
+  - Filesystem.process_guid 
+  - Filesystem.user
+  risk_score: 42
+  security_domain: endpoint
diff --git a/tests/endpoint/linux_java_writing_jsp_file.test.yml b/tests/endpoint/linux_java_writing_jsp_file.test.yml
new file mode 100644
index 0000000000..9374429a2c
--- /dev/null
+++ b/tests/endpoint/linux_java_writing_jsp_file.test.yml
@@ -0,0 +1,12 @@
+name: Linux Java Writing JSP File Unit Test
+tests:
+- name: Linux Java Writing JSP File
+  file: endpoint/linux_java_writing_jsp_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: java_write_jsp-linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file

From a03b6719dedc0cc439e38aaf7772992f808708a6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 5 Apr 2022 15:36:38 -0600
Subject: [PATCH 3/9] function and CVE-2022-22965 fixes

---
 .../endpoint/linux_java_spawning_shell.yml    |  2 +-
 .../endpoint/linux_java_writing_jsp_file.yml  |  4 +-
 .../web/spring4shell_payload_url_request.yml  |  4 +-
 detections/web/web_jsp_request_via_url.yml    |  6 +-
 ...b_spring_cloud_function_functionrouter.yml | 69 +++++++++++++++++++
 ...63.yml => spring4shell_cve_2022_22965.yml} |  4 +-
 ...ing_cloud_function_functionrouter.test.yml | 12 ++++
 7 files changed, 91 insertions(+), 10 deletions(-)
 create mode 100644 detections/web/web_spring_cloud_function_functionrouter.yml
 rename stories/{spring4shell_cve_2022_22963.yml => spring4shell_cve_2022_22965.yml} (94%)
 create mode 100644 tests/web/web_spring_cloud_function_functionrouter.test.yml

diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml
index b97945bcf9..186d6a47fc 100644
--- a/detections/endpoint/linux_java_spawning_shell.yml
+++ b/detections/endpoint/linux_java_spawning_shell.yml
@@ -32,7 +32,7 @@ tags:
   analytic_story:
   - Hermetic Wiper
   - Log4Shell CVE-2021-44228
-  - Spring4Shell CVE-2022-22963
+  - Spring4Shell CVE-2022-22965
   asset_type: Endpoint
   confidence: 50
   context:
diff --git a/detections/endpoint/linux_java_writing_jsp_file.yml b/detections/endpoint/linux_java_writing_jsp_file.yml
index 255bbefac4..724aa7bb5b 100644
--- a/detections/endpoint/linux_java_writing_jsp_file.yml
+++ b/detections/endpoint/linux_java_writing_jsp_file.yml
@@ -25,9 +25,9 @@ references:
 - https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
 tags:
   analytic_story:
-  - Spring4Shell CVE-2022-22963
+  - Spring4Shell CVE-2022-22965
   cve:
-  - CVE-2022-22963
+  - CVE-2022-22965
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/web/spring4shell_payload_url_request.yml b/detections/web/spring4shell_payload_url_request.yml
index 9b8ec01232..72f95362d8 100644
--- a/detections/web/spring4shell_payload_url_request.yml
+++ b/detections/web/spring4shell_payload_url_request.yml
@@ -24,9 +24,9 @@ references:
 - https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
 tags:
   analytic_story:
-  - Spring4Shell CVE-2022-22963
+  - Spring4Shell CVE-2022-22965
   cve:
-  - CVE-2022-22963
+  - CVE-2022-22965
   asset_type: Web Server
   cis20:
   - CIS 3
diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml
index 66c087b061..47300426d4 100644
--- a/detections/web/web_jsp_request_via_url.yml
+++ b/detections/web/web_jsp_request_via_url.yml
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Web
-description: The following analytic identifies the common URL requests used by a recent CVE - CVE-2022-22963, or Spring4Shell, to access a webshell on the remote webserver.
+description: The following analytic identifies the common URL requests used by a recent CVE - CVE-2022-22965, or Spring4Shell, to access a webshell on the remote webserver.
   The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
 search: '| tstats count from datamodel=Web where Web.http_method IN ("GET")
   Web.url IN ("*.jsp?cmd=*","*j&cmd=*")
@@ -24,9 +24,9 @@ references:
 - https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
 tags:
   analytic_story:
-  - Spring4Shell CVE-2022-22963
+  - Spring4Shell CVE-2022-22965
   cve:
-  - CVE-2022-22963
+  - CVE-2022-22965
   asset_type: Web Server
   cis20:
   - CIS 3
diff --git a/detections/web/web_spring_cloud_function_functionrouter.yml b/detections/web/web_spring_cloud_function_functionrouter.yml
new file mode 100644
index 0000000000..1b178baa17
--- /dev/null
+++ b/detections/web/web_spring_cloud_function_functionrouter.yml
@@ -0,0 +1,69 @@
+name: Web Spring Cloud Function FunctionRouter
+id: 89dddbad-369a-4f8a-ace2-2439218735bc
+version: 1
+date: '2022-04-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic identifies activity related to the web application Spring Cloud Function that was recently idenfied as vulnerable. This is CVE-2022-22963.
+  Multiple proof of concept code was released. 
+  The URI that is hit includes `functionrouter`. The specifics of the exploit include a status of 500. In this query we did not include it, but for filtering you can add Web.status=500.
+  The exploit data itself (based on all the POCs) is located in the form_data field. This field will include all class.modules being called.
+search: '| tstats count from datamodel=Web where Web.http_method IN ("POST") Web.url="*/functionRouter*"
+  by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.status sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `web_spring_cloud_function_functionrouter_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. 
+known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
+references:
+- https://github.com/rapid7/metasploit-framework/pull/16395
+- https://github.com/hktalent/spring-spel-0day-poc
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22965
+  cve:
+  - CVE-2022-22963
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/all_functionrouter_http_streams.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud.
+  mitre_attack_id:
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: Other
+    role:
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  risk_score: 42
+  security_domain: network
diff --git a/stories/spring4shell_cve_2022_22963.yml b/stories/spring4shell_cve_2022_22965.yml
similarity index 94%
rename from stories/spring4shell_cve_2022_22963.yml
rename to stories/spring4shell_cve_2022_22965.yml
index cfbaf147ce..128c8dffc9 100644
--- a/stories/spring4shell_cve_2022_22963.yml
+++ b/stories/spring4shell_cve_2022_22965.yml
@@ -1,4 +1,4 @@
-name: Spring4Shell CVE-2022-22963
+name: Spring4Shell CVE-2022-22965
 id: dcc19913-6918-4ed2-bbba-a6b484c10ef4
 version: 1
 date: '2022-04-05'
@@ -20,7 +20,7 @@ According to Spring, the following requirements were included in the vulnerabili
 references:
 - https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
 tags:
-  analytic_story: Spring4Shell CVE-2022-22963
+  analytic_story: Spring4Shell CVE-2022-22965
   category:
   - Adversary Tactics
   product:
diff --git a/tests/web/web_spring_cloud_function_functionrouter.test.yml b/tests/web/web_spring_cloud_function_functionrouter.test.yml
new file mode 100644
index 0000000000..a7adb13d9d
--- /dev/null
+++ b/tests/web/web_spring_cloud_function_functionrouter.test.yml
@@ -0,0 +1,12 @@
+name: Web Spring Cloud Function FunctionRouter Unit Test
+tests:
+- name: Web Spring Cloud Function FunctionRouter
+  file: web/web_spring_cloud_function_functionrouter.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: all_functionrouter_http_streams.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/all_functionrouter_http_streams.log
+    source: stream:http
+    sourcetype: stream:http

From bc2ab62ee8854bcab75e61e0cfd49cb7b5c5a423 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 5 Apr 2022 15:41:35 -0600
Subject: [PATCH 4/9] typo

---
 ...ection_via_url.test.yml => web_jsp_request_via_url.test.yml} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename tests/web/{web_jsp_injection_via_url.test.yml => web_jsp_request_via_url.test.yml} (92%)

diff --git a/tests/web/web_jsp_injection_via_url.test.yml b/tests/web/web_jsp_request_via_url.test.yml
similarity index 92%
rename from tests/web/web_jsp_injection_via_url.test.yml
rename to tests/web/web_jsp_request_via_url.test.yml
index e9659c4210..5108af9f3c 100644
--- a/tests/web/web_jsp_injection_via_url.test.yml
+++ b/tests/web/web_jsp_request_via_url.test.yml
@@ -1,6 +1,6 @@
 name: Web JSP Request via URL Unit Test
 tests:
-- name: Web JSP Injection via URL
+- name: Web JSP Request via URL
   file: web/web_jsp_request_via_url.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h

From ebb920f47de86d30751564e84b4e2ebe39ddd9c9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 6 Apr 2022 08:39:34 -0600
Subject: [PATCH 5/9] rename

---
 ..._java_writing_jsp_file.yml => java_writing_jsp_file.yml} | 6 +++---
 ...ing_jsp_file.test.yml => java_writing_jsp_file.test.yml} | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)
 rename detections/endpoint/{linux_java_writing_jsp_file.yml => java_writing_jsp_file.yml} (95%)
 rename tests/endpoint/{linux_java_writing_jsp_file.test.yml => java_writing_jsp_file.test.yml} (75%)

diff --git a/detections/endpoint/linux_java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml
similarity index 95%
rename from detections/endpoint/linux_java_writing_jsp_file.yml
rename to detections/endpoint/java_writing_jsp_file.yml
index 724aa7bb5b..924dfe03bd 100644
--- a/detections/endpoint/linux_java_writing_jsp_file.yml
+++ b/detections/endpoint/java_writing_jsp_file.yml
@@ -1,4 +1,4 @@
-name: Linux Java Writing JSP File
+name: Java Writing JSP File
 id: eb65619c-4f8d-4383-a975-d352765d344b
 version: 1
 date: '2022-04-05'
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. 
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=java
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe")
   by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
   Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
   `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
   file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
   as lastTime by dest process_name process_guid file_name file_path file_create_time
-  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_writing_jsp_file_filter`'
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_writing_jsp_file_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment.
 references:
diff --git a/tests/endpoint/linux_java_writing_jsp_file.test.yml b/tests/endpoint/java_writing_jsp_file.test.yml
similarity index 75%
rename from tests/endpoint/linux_java_writing_jsp_file.test.yml
rename to tests/endpoint/java_writing_jsp_file.test.yml
index 9374429a2c..47af9067d1 100644
--- a/tests/endpoint/linux_java_writing_jsp_file.test.yml
+++ b/tests/endpoint/java_writing_jsp_file.test.yml
@@ -1,7 +1,7 @@
-name: Linux Java Writing JSP File Unit Test
+name: Java Writing JSP File Unit Test
 tests:
-- name: Linux Java Writing JSP File
-  file: endpoint/linux_java_writing_jsp_file.yml
+- name: Java Writing JSP File
+  file: endpoint/java_writing_jsp_file.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

From 8649a7c9902b86b663af269353c854a6ba486060 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 6 Apr 2022 09:58:24 -0600
Subject: [PATCH 6/9] Web Spring4Shell HTTP Request Class Module

---
 detections/web/web_jsp_request_via_url.yml    |  4 +-
 ...spring4shell_http_request_class_module.yml | 68 +++++++++++++++++++
 ...g4shell_http_request_class_module.test.yml | 12 ++++
 3 files changed, 81 insertions(+), 3 deletions(-)
 create mode 100644 detections/web/web_spring4shell_http_request_class_module.yml
 create mode 100644 tests/web/web_spring4shell_http_request_class_module.test.yml

diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml
index 47300426d4..19b4dce3d5 100644
--- a/detections/web/web_jsp_request_via_url.yml
+++ b/detections/web/web_jsp_request_via_url.yml
@@ -69,6 +69,4 @@ tags:
   - Web.dest
   - Web.http_user_agent
   risk_score: 72
-  security_domain: network
-
-
+  security_domain: network
\ No newline at end of file
diff --git a/detections/web/web_spring4shell_http_request_class_module.yml b/detections/web/web_spring4shell_http_request_class_module.yml
new file mode 100644
index 0000000000..c8b936895f
--- /dev/null
+++ b/detections/web/web_spring4shell_http_request_class_module.yml
@@ -0,0 +1,68 @@
+name: Web Spring4Shell HTTP Request Class Module
+id: fcdfd69d-0ca3-4476-920e-9b633cb4593e
+version: 1
+date: '2022-04-06'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic identifies the payload related to Spring4Shell, CVE-2022-22965. This analytic uses Splunk Stream HTTP to view the http request body, form data. STRT reviewed all the current proof of concept code and determined the commonality with the payloads being passed used the same fields "class.module.classLoader.resources.context.parent.pipeline.first".
+search: '`stream_http` http_method IN ("POST")
+  | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out
+  | search http_request_body IN ("*class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=_*", "*class.module.classLoader.resources.context.parent.pipeline.first.pattern*","*suffix=.jsp*")
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `web_spring4shell_http_request_class_module_filter`'
+how_to_implement: 
+known_false_positives: False positives may occur and filtering may be required. Restrict analytic to asset type.
+references:
+- https://github.com/DDuarte/springshell-rce-poc/blob/master/poc.py
+tags:
+  analytic_story:
+  - Spring4Shell CVE-2022-22965
+  cve:
+  - CVE-2022-22965
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/http_request_body_streams.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A http body request related to Spring4Shell has been sent to $dest$ by $src$.
+  mitre_attack_id:
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: Other
+    role:
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - http_request_body
+  - http_method
+  - http_user_agent
+  - uri_path 
+  - url 
+  - bytes_in 
+  - bytes_out
+  risk_score: 72
+  security_domain: network
+
+
diff --git a/tests/web/web_spring4shell_http_request_class_module.test.yml b/tests/web/web_spring4shell_http_request_class_module.test.yml
new file mode 100644
index 0000000000..c64a24e196
--- /dev/null
+++ b/tests/web/web_spring4shell_http_request_class_module.test.yml
@@ -0,0 +1,12 @@
+name: Web Spring4Shell HTTP Request Class Module Unit Test
+tests:
+- name: Web Spring4Shell HTTP Request Class Module
+  file: web/web_spring4shell_http_request_class_module.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: http_request_body_streams.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/http_request_body_streams.log
+    source: stream:http
+    sourcetype: stream:http

From 9f370036f5aeaad47e3fa9668744039b9e3fee00 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 6 Apr 2022 10:26:23 -0600
Subject: [PATCH 7/9] Update web_spring4shell_http_request_class_module.yml

---
 detections/web/web_spring4shell_http_request_class_module.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/detections/web/web_spring4shell_http_request_class_module.yml b/detections/web/web_spring4shell_http_request_class_module.yml
index c8b936895f..043652e5d2 100644
--- a/detections/web/web_spring4shell_http_request_class_module.yml
+++ b/detections/web/web_spring4shell_http_request_class_module.yml
@@ -13,7 +13,9 @@ search: '`stream_http` http_method IN ("POST")
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `web_spring4shell_http_request_class_module_filter`'
-how_to_implement: 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the stream HTTP logs or network logs that catch network traffic. Make
+  sure that the http-request-body, payload, or request field is enabled.
 known_false_positives: False positives may occur and filtering may be required. Restrict analytic to asset type.
 references:
 - https://github.com/DDuarte/springshell-rce-poc/blob/master/poc.py

From f457ffed900bec3e1143054221d3c224df0c882e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 6 Apr 2022 13:47:38 -0600
Subject: [PATCH 8/9] Update java_writing_jsp_file.yml

---
 detections/endpoint/java_writing_jsp_file.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml
index 924dfe03bd..ad7adf98b7 100644
--- a/detections/endpoint/java_writing_jsp_file.yml
+++ b/detections/endpoint/java_writing_jsp_file.yml
@@ -11,7 +11,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
   Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
   `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where
-  Filesystem.file_name="*.jsp" by _time Filesystem.dest Filesystem.file_create_time
+  Filesystem.file_name="*.jsp*" by _time Filesystem.dest Filesystem.file_create_time
   Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user
   | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
   file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)

From 2c8fa42b98c1a7c1f6ad13929e3ec55676618af3 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 6 Apr 2022 14:03:06 -0700
Subject: [PATCH 9/9] minor updates and gitignore

---
 .gitignore                                             | 10 +++++-----
 detections/web/spring4shell_payload_url_request.yml    |  6 +++---
 detections/web/web_jsp_request_via_url.yml             |  4 ++--
 .../web/web_spring4shell_http_request_class_module.yml |  4 ++--
 .../web/web_spring_cloud_function_functionrouter.yml   |  4 ++--
 5 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.gitignore b/.gitignore
index f7fcc7cdc9..dbcd196ffc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -117,8 +117,8 @@ package/default/sftp-config.json
 notes
 
 # detection_testing_batch innteractive mode
-bin/automated_detection_testing/ci/detection_testing_batch/*-test-run.json
-bin/automated_detection_testing/ci/detection_testing_batch/apps/
-bin/automated_detection_testing/ci/detection_testing_batch/security_content/
-bin/automated_detection_testing/ci/detection_testing_batch/test_config.json
-bin/automated_detection_testing/ci/detection_testing_batch/test_results/
+bin/docker_detection_tester/*-test-run.json
+bin/docker_detection_tester/apps/
+bin/docker_detection_tester/security_content/
+bin/docker_detection_tester/test_config.json
+bin/docker_detection_tester/test_results/
diff --git a/detections/web/spring4shell_payload_url_request.yml b/detections/web/spring4shell_payload_url_request.yml
index 72f95362d8..34c689188d 100644
--- a/detections/web/spring4shell_payload_url_request.yml
+++ b/detections/web/spring4shell_payload_url_request.yml
@@ -49,13 +49,13 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
+    type: IP Address
     role:
     - Victim
   - name: src
-    type: Other
+    type: IP Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml
index 19b4dce3d5..febd4024e9 100644
--- a/detections/web/web_jsp_request_via_url.yml
+++ b/detections/web/web_jsp_request_via_url.yml
@@ -53,9 +53,9 @@ tags:
     role:
     - Victim
   - name: src
-    type: Other
+    type: IP Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/web/web_spring4shell_http_request_class_module.yml b/detections/web/web_spring4shell_http_request_class_module.yml
index 043652e5d2..04365c9289 100644
--- a/detections/web/web_spring4shell_http_request_class_module.yml
+++ b/detections/web/web_spring4shell_http_request_class_module.yml
@@ -48,9 +48,9 @@ tags:
     role:
     - Victim
   - name: src
-    type: Other
+    type: IP Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/web/web_spring_cloud_function_functionrouter.yml b/detections/web/web_spring_cloud_function_functionrouter.yml
index 1b178baa17..643598d178 100644
--- a/detections/web/web_spring_cloud_function_functionrouter.yml
+++ b/detections/web/web_spring_cloud_function_functionrouter.yml
@@ -50,9 +50,9 @@ tags:
     role:
     - Victim
   - name: src
-    type: Other
+    type: IP Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security