From 872fa44741fe9974303bf564f01a295599b91a35 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:04:12 -0700 Subject: [PATCH 01/11] initialdraft --- ...sonation_weak_encryption_configuration.yml | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml new file mode 100644 index 0000000000..d4065a6a07 --- /dev/null +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -0,0 +1,51 @@ +name: Splunk protocol impersonation weak encryption configuration +id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +version: 1 +date: '2022-05-24' +author: Rod Soto, Splunk +type: TTP +datamodel: [] +search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' +description: On . +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. +known_false_positives: This search may find additional path traversal exploitation attempts. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-0000 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt + impact: 50 + kill_chain_phases: + - Exploitation + message: Path traversal exploitation attempt from $clientip$ + mitre_attack_id: + - T1083 + observable: + - name: clientip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - status + - clientip + - method + - uri_path + - uri_query + risk_score: 40 + security_domain: threat From 352ac64d51b8cf8b1bf2b025666e6db007e38084 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:12:46 -0700 Subject: [PATCH 02/11] initialdrafta --- ...ol_impersonation_weak_encryption_configuration.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index d4065a6a07..c657d3c10d 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -3,14 +3,15 @@ id: 839d12a6-b119-4d44-ac4f-13eed95412c8 version: 1 date: '2022-05-24' author: Rod Soto, Splunk -type: TTP +type: Hunting datamodel: [] search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' -description: On . -how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. -known_false_positives: This search may find additional path traversal exploitation attempts. +description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html +- https://www.splunk.com/en_us/product-security. +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: - Splunk Vulnerabilities From 9d1e62c7d05077dce1635b8f512798bbb464c3bf Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:55:47 -0700 Subject: [PATCH 03/11] initialdraftb --- ...sonation_weak_encryption_configuration.yml | 24 +++++++------------ 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index c657d3c10d..c593f9f514 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -8,7 +8,7 @@ datamodel: [] search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. -known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: - https://www.splunk.com/en_us/product-security. - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation @@ -18,35 +18,29 @@ tags: asset_type: Endpoint cve: - CVE-2022-0000 - cis20: - - CIS 3 - - CIS 5 - - CIS 16 confidence: 80 context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt impact: 50 kill_chain_phases: - Exploitation - message: Path traversal exploitation attempt from $clientip$ + message: Failed to validate certificate on host$ mitre_attack_id: - T1083 observable: - - name: clientip - type: IP Address + - name: host + type: host role: - - Attacker + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - status - - clientip - - method - - uri_path - - uri_query + - host + - event_message + - component risk_score: 40 security_domain: threat From a802fecce8e0540e1239832bcb02f919a8d91cb3 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 14:01:02 -0700 Subject: [PATCH 04/11] initialdraftc --- ...unk_protocol_impersonation_weak_encryption_configuration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index c593f9f514..be511b8fe2 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -28,7 +28,7 @@ tags: - Exploitation message: Failed to validate certificate on host$ mitre_attack_id: - - T1083 + - T1588.004 observable: - name: host type: host From 99d314eeeae5398ec7bb068a1bf371cab80b4611 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:29:15 -0700 Subject: [PATCH 05/11] initialsearchskeleton --- ...l_impersonation_weak_encryption_configuration.yml | 8 ++++---- macros/splk_cert_validation_tls.yml | 4 ++++ ...ersonation_weak_encryption_configuration.test.yml | 12 ++++++++++++ 3 files changed, 20 insertions(+), 4 deletions(-) create mode 100644 macros/splk_cert_validation_tls.yml create mode 100644 tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index be511b8fe2..0f1bbb86ef 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -5,12 +5,12 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' +search: '|splk_cert_validation_tls event_message="*SSL*" AND event_message="*ERROR*" component=HttpListener | stats count by host component event_message |dedup host | splunk_protocol_impersonation_weak_encryption_configuration_filter' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: -- https://www.splunk.com/en_us/product-security. +- https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: @@ -22,13 +22,13 @@ tags: context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt impact: 50 kill_chain_phases: - Exploitation message: Failed to validate certificate on host$ mitre_attack_id: - - T1588.004 + - T1588.004 observable: - name: host type: host diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml new file mode 100644 index 0000000000..7162e5e54f --- /dev/null +++ b/macros/splk_cert_validation_tls.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunkd +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunkd diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml new file mode 100644 index 0000000000..de04dc05c5 --- /dev/null +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml @@ -0,0 +1,12 @@ +name: Splunk protocol impersonation weak encryption configuration Unit Test +tests: +- name: Splunk protocol impersonation weak encryption configuration + file: application/splunk_protocol_impersonation_weak_encryption_configuration.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splk_protocol_impersonation_weak_encryption_configuration.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd From 5680afbce7ee0b33086a9bb78b247660b92b463f Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:35:46 -0700 Subject: [PATCH 06/11] fixtype --- ...unk_protocol_impersonation_weak_encryption_configuration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 0f1bbb86ef..77a9a1e58a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -31,7 +31,7 @@ tags: - T1588.004 observable: - name: host - type: host + type: hostname role: - Victim product: From 16641935e0bab34c72a6d0ac6dc6a20ede4fc994 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:37:39 -0700 Subject: [PATCH 07/11] fixanotherytpo --- ...k_protocol_impersonation_weak_encryption_configuration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 77a9a1e58a..1c7765c87c 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -30,8 +30,8 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: host - type: hostname + - name: hostname + type: hostname role: - Victim product: From 6ee71634218e027902a8a853293ed6da42c588eb Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:40:12 -0700 Subject: [PATCH 08/11] Hostname --- ...k_protocol_impersonation_weak_encryption_configuration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 1c7765c87c..e822c6a1ad 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -30,8 +30,8 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: hostname - type: hostname + - name: Hostname + type: Hostname role: - Victim product: From b51c08851337622a586344cd9aeb2734600f086c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 10:55:42 -0500 Subject: [PATCH 09/11] Fixing typo --- tests/application/splunk_user_enumeration_attempt.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_user_enumeration_attempt.test.yml b/tests/application/splunk_user_enumeration_attempt.test.yml index 40e966b1af..e2672a23c5 100644 --- a/tests/application/splunk_user_enumeration_attempt.test.yml +++ b/tests/application/splunk_user_enumeration_attempt.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: audittail.log + - file_name: audittrail.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log source: audittrail sourcetype: audittrail From ef545637557f8d0e387ba103952a9d2fdb35cfe0 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 13:54:26 -0500 Subject: [PATCH 10/11] Adding detection --- ...sonation_weak_encryption_configuration.yml | 45 ++++++++++--------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index e822c6a1ad..e3f2dfbc9a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -1,46 +1,47 @@ -name: Splunk protocol impersonation weak encryption configuration -id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +name: Splunk Protocol Impersonation Weak Encryption Configuration +id: 900892bf-70a9-4787-8c99-546dd98ce461 version: 1 -date: '2022-05-24' -author: Rod Soto, Splunk +date: '2022-05-25' +author: Lou Stella, Splunk type: Hunting datamodel: [] -search: '|splk_cert_validation_tls event_message="*SSL*" AND event_message="*ERROR*" component=HttpListener | stats count by host component event_message |dedup host | splunk_protocol_impersonation_weak_encryption_configuration_filter' -description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. -known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. references: -- https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - cve: - - CVE-2022-0000 - confidence: 80 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log impact: 50 kill_chain_phases: - Exploitation - message: Failed to validate certificate on host$ + message: $splunk_server$ may not be properly validating TLS Certificates mitre_attack_id: - - T1588.004 + - T1001.003 + nist: + - DE.CM observable: - - name: Hostname - type: Hostname + - name: splunk_server + type: hostname role: - - Victim + - victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - host - - event_message - - component - risk_score: 40 + - none + risk_score: 50 security_domain: threat From 7bd84418068bfb3989af7bca4491af2c2400d959 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 13:55:43 -0500 Subject: [PATCH 11/11] Adding test, random data since irrelevant to detection --- ...rsonation_weak_encryption_configuration.test.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml index de04dc05c5..30ec9e3e5f 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml @@ -1,12 +1,13 @@ -name: Splunk protocol impersonation weak encryption configuration Unit Test +name: Splunk Protocol Impersonation Weak Encryption Configuration Unit Test tests: -- name: Splunk protocol impersonation weak encryption configuration +- name: Splunk Protocol Impersonation Weak Encryption Configuration file: application/splunk_protocol_impersonation_weak_encryption_configuration.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now attack_data: - - file_name: splk_protocol_impersonation_weak_encryption_configuration.txt - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt - source: "/opt/splunk/var/log/splunk/splunkd.log" - sourcetype: splunkd + - file_name: audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true