Add timing to searches

detections/application/splunk_absolute_path_traversal_using_runshellscript.yml

@@ -8,7 +8,8 @@ type: Hunting
 data_source:
 - python.log
 description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
-search: '`splunk_python` *runshellscript* | `splunk_absolute_path_traversal_using_runshellscript_filter`'
+search: '`splunk_python` *runshellscript* | stats count min(_time)
+  as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_absolute_path_traversal_using_runshellscript_filter`'
 how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. 
 known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script.
 references:

detections/application/splunk_cmd_injection_using_external_lookups.yml

@@ -8,8 +8,8 @@ type: Hunting
 data_source:
 - audittrial
 description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
-search: '`audit_searches` search = "| *runshellscript* """ | stats earliest(_time) as event_time count by search user splunk_server 
-  | convert ctime(event_time)  | `splunk_cmd_injection_using_external_lookups_filter`'
+search: '`audit_searches` search = "| *runshellscript* """ | stats count min(_time) as firstTime max(_time) as lastTime by search user splunk_server 
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_cmd_injection_using_external_lookups_filter`'
 how_to_implement: Must have access to internal audit index. 
 known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. 
 references:

detections/application/splunk_dos_using_malformed_saml_request.yml

@@ -8,7 +8,7 @@ type: Hunting
 data_source:
 - splunkd.log 
 description: In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang.
-search: '`splunkd` event_message=*error* expr=*xpointer* | stats count by component expr host event_message | `splunk_dos_using_malformed_saml_request_filter`'
+search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) as firstTime max(_time) as lastTime by component expr host event_message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`'
 how_to_implement: To run this search, you must have access to the _internal index. 
 known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file. 
 references:

detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml

@@ -8,7 +8,7 @@ type: Hunting
 data_source:
 - web_access.log 
 description: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the app search table web endpoint, which presents as the Create Table View page in Splunk Web. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. A JavaScript file within this web endpoint does not properly validate input which lets an attacker insert a payload into a function.
-search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats earliest(_time) as event_time count by clientip status user view root uri_path | convert ctime(event_time) | `splunk_reflected_xss_on_app_search_table_endpoint_filter`'
+search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats count min(_time) as firstTime max(_time) as lastTime by clientip status user view root uri_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_reflected_xss_on_app_search_table_endpoint_filter`'
 how_to_implement: Need access to the internal indexes. 
 known_false_positives: This search will produce false positives. It is necessary to also look at uri_query parameter to determine the possible malicious intention of inserting makeresults within the uri string. 
 references: