renamedsearch

detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml

@@ -0,0 +1,47 @@
+name: Splunk Protocol Impersonation Weak Encryption Configuration
+id: 900892bf-70a9-4787-8c99-546dd98ce461
+version: 1
+date: '2022-05-25'
+author: Lou Stella, Splunk
+type: Hunting
+datamodel: []
+description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
+search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings |  table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`'
+how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. 
+known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration.
+references:
+- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: $splunk_server$ may not be properly validating TLS Certificates
+  mitre_attack_id:
+  - T1001.003
+  nist:
+  - DE.CM
+  observable:
+  - name: splunk_server
+    type: hostname
+    role:
+    - victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - none
+  risk_score: 50
+  security_domain: threat

macros/splk_cert_validation_tls.yml

@@ -1,4 +1,11 @@
+<<<<<<< HEAD
 definition: index=_internal sourcetype=splunk_python source=/opt/splunk/var/log/splunk/python.log
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: splunk_protocol_impersonation_weak_encryption_simplerequest 
+=======
+definition: index=_internal sourcetype=splunkd
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: splunkd
+>>>>>>> 7bd84418068bfb3989af7bca4491af2c2400d959

tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml

@@ -0,0 +1,13 @@
+name: Splunk Protocol Impersonation Weak Encryption Configuration Unit Test
+tests:
+- name: Splunk Protocol Impersonation Weak Encryption Configuration
+  file: application/splunk_protocol_impersonation_weak_encryption_configuration.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
+    source: audittrail
+    sourcetype: audittrail
+    update_timestamp: true

tests/application/splunk_user_enumeration_attempt.test.yml

@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: audittail.log
+  - file_name: audittrail.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log
     source: audittrail
     sourcetype: audittrail