From de6ccbbf9cbd576ec2ad68572ae173b61c549a9d Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 27 Apr 2022 12:44:48 -0500 Subject: [PATCH 01/12] CVE-2022-27183 --- .../splunk_xss_in_monitoring_console.yml | 54 +++++++++++++++++++ macros/splunkd_web.yml | 4 ++ .../splunk_xss_in_monitoring_console.test.yml | 12 +++++ 3 files changed, 70 insertions(+) create mode 100644 detections/application/splunk_xss_in_monitoring_console.yml create mode 100644 macros/splunkd_web.yml create mode 100644 tests/application/splunk_xss_in_monitoring_console.test.yml diff --git a/detections/application/splunk_xss_in_monitoring_console.yml b/detections/application/splunk_xss_in_monitoring_console.yml new file mode 100644 index 0000000000..6a5abc38e2 --- /dev/null +++ b/detections/application/splunk_xss_in_monitoring_console.yml @@ -0,0 +1,54 @@ +name: Splunk XSS in Monitoring Console +id: b11accac-6fa3-4103-8a1a-7210f1a67087 +version: 1 +date: '2022-04-27' +author: Lou Stella, Splunk +type: TTP +datamodel: [] +description: On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Site Scripting (XSS) vulnerability stemming from the lack of input validation in the Distributed Monitoring Console app. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +search: ' `splunkd_web` method="GET" uri_query="description=%3C*" | table _time host status clientip user uri | `splunk_xss_in_monitoring_console_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. +known_false_positives: Use of the monitoring console where the less-than sign (<) is the first character in the description field. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-27183 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/xss/splunk_web_access.log + impact: 50 + kill_chain_phases: + - Exploitation + message: UPDATE message + mitre_attack_id: + - T1189 + nist: + - DE.CM + observable: + - name: host + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - method + - uri_query + - status + - clientip + - user + - uri + risk_score: 40 + security_domain: threat diff --git a/macros/splunkd_web.yml b/macros/splunkd_web.yml new file mode 100644 index 0000000000..95e6ca7cbf --- /dev/null +++ b/macros/splunkd_web.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunk_web_access +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunkd_web \ No newline at end of file diff --git a/tests/application/splunk_xss_in_monitoring_console.test.yml b/tests/application/splunk_xss_in_monitoring_console.test.yml new file mode 100644 index 0000000000..792c2e98a8 --- /dev/null +++ b/tests/application/splunk_xss_in_monitoring_console.test.yml @@ -0,0 +1,12 @@ +name: Splunk XSS in Monitoring Console Unit Test +tests: +- name: Splunk XSS in Monitoring Console + file: application/splunk_xss_in_monitoring_console.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splunk_web_access.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/xss/splunk_web_access.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access From 32ac03764674b1f69f0934590b00fa07ff3c1eb0 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 27 Apr 2022 13:37:29 -0500 Subject: [PATCH 02/12] updated message --- detections/application/splunk_xss_in_monitoring_console.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_xss_in_monitoring_console.yml b/detections/application/splunk_xss_in_monitoring_console.yml index 6a5abc38e2..a1e5aa0173 100644 --- a/detections/application/splunk_xss_in_monitoring_console.yml +++ b/detections/application/splunk_xss_in_monitoring_console.yml @@ -29,7 +29,7 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: UPDATE message + message: A potential XSS attempt has been detected from $user$ mitre_attack_id: - T1189 nist: From c61f8670f823a1776075abca455633ec64fbb1c9 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Fri, 29 Apr 2022 11:31:33 -0500 Subject: [PATCH 03/12] CVE-2021-33845 --- .../splunk_user_enumeration_attempt.yml | 52 +++++++++++++++++++ macros/splunkd_failed_auths.yml | 4 ++ .../splunk_user_enumeration_attempt.test.yml | 12 +++++ 3 files changed, 68 insertions(+) create mode 100644 detections/application/splunk_user_enumeration_attempt.yml create mode 100644 macros/splunkd_failed_auths.yml create mode 100644 tests/application/splunk_user_enumeration_attempt.test.yml diff --git a/detections/application/splunk_user_enumeration_attempt.yml b/detections/application/splunk_user_enumeration_attempt.yml new file mode 100644 index 0000000000..15777925b2 --- /dev/null +++ b/detections/application/splunk_user_enumeration_attempt.yml @@ -0,0 +1,52 @@ +name: Splunk User Enumeration Attempt +id: 25625cb4-1c4d-4463-b0f9-7cb462699cde +version: 1 +date: '2022-04-29' +author: Lou Stella, Splunk +type: TTP +datamodel: [] +description: On May 3rd, 2022, Splunk published a security advisory for username enumeration stemming from verbose login failure messages present on some REST endpoints. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. +search: ' `splunkd_failed_auths` | stats count(user) as auths by user, src | where auths>5 | stats values(user) as "Users", sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames. +known_false_positives: Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0303.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + cve: + - CVE-2021-33845 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log + impact: 50 + kill_chain_phases: + - Reconnaissance + message: $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected. + mitre_attack_id: + - T1078 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - user + - src + - info + - action + risk_score: 40 + security_domain: access diff --git a/macros/splunkd_failed_auths.yml b/macros/splunkd_failed_auths.yml new file mode 100644 index 0000000000..54a9027bb5 --- /dev/null +++ b/macros/splunkd_failed_auths.yml @@ -0,0 +1,4 @@ +definition: index=_audit action="login attempt" info="failed" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunkd_failed_auths \ No newline at end of file diff --git a/tests/application/splunk_user_enumeration_attempt.test.yml b/tests/application/splunk_user_enumeration_attempt.test.yml new file mode 100644 index 0000000000..40e966b1af --- /dev/null +++ b/tests/application/splunk_user_enumeration_attempt.test.yml @@ -0,0 +1,12 @@ +name: Splunk User Enumeration Attempt Unit Test +tests: +- name: Splunk User Enumeration Attempt + file: application/splunk_user_enumeration_attempt.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: audittail.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log + source: audittrail + sourcetype: audittrail From c43dc89bbfb86d6fb3d8bda770e6d1650d308d23 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 29 Apr 2022 10:17:14 -0700 Subject: [PATCH 04/12] detectionsforlocalprivescpathtraversal --- .../local_privesc_via_nodejs_default_path.yml | 49 +++++++++++++++++ .../path_traversal_spl_injection.yml | 53 +++++++++++++++++++ .../splunk_xss_in_monitoring_console.yml | 8 +-- macros/local_privesc_nodejs_splunk.yml | 4 ++ macros/path_traversal_spl_injection.yml | 4 ++ ...l_privesc_via_nodejs_default_path.test.yml | 12 +++++ .../path_traversal_spl_injection.test.yml | 12 +++++ 7 files changed, 138 insertions(+), 4 deletions(-) create mode 100644 detections/application/local_privesc_via_nodejs_default_path.yml create mode 100644 detections/application/path_traversal_spl_injection.yml create mode 100644 macros/local_privesc_nodejs_splunk.yml create mode 100644 macros/path_traversal_spl_injection.yml create mode 100644 tests/application/local_privesc_via_nodejs_default_path.test.yml create mode 100644 tests/application/path_traversal_spl_injection.test.yml diff --git a/detections/application/local_privesc_via_nodejs_default_path.yml b/detections/application/local_privesc_via_nodejs_default_path.yml new file mode 100644 index 0000000000..21dc5dd6d3 --- /dev/null +++ b/detections/application/local_privesc_via_nodejs_default_path.yml @@ -0,0 +1,49 @@ +name: Local privesc via nodejs default path +id: b2d7bdef-3650-415e-a4f7-85e6d6829472 +version: 1 +date: '2022-04-29' +author: Rod Soto, Splunk +type: TTP +datamodel: [] +description: On May 3rd, 2022, Splunk published a security advisory for a privilege escalation vulnerability via Nodejs Default path. This vulnerability affects Windows and Unix based systems, and it allows a local low privilege user to gain SYSTEM in windows systems and in Unix based system the impact is lower as standard users cannot write under /opt directory. +search: '`local_privesc_nodejs_splunk` search= makeresults | eval t= printf(\"*\") roles=user provenance=UI:Dashboard:* | stats count by action user savedsearch_name search | `local_privesc_via_nodejs_default_path_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search will provide users executing potentially exploitable command functionat search function. +known_false_positives: In addition to the above search, the following search 'index=_internal pdf source="c:\\opt\\splunk\\var\\log\\splunk\\pdfgen.log" | table splunk_server filename date_mday date_hour' will provide time and document exported to PDF in order to find out low privilege user executing vulnerable function plus the export to PDF to complete exploit. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2021-42743 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/local_privesc_via_nodes_default_path.txt + impact: 50 + kill_chain_phases: + - Exploitation + message: A potential exploitable function has been executed by $user$ + mitre_attack_id: + - T1548 + observable: + - name: user + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - search + - roles + - provenance + risk_score: 40 + security_domain: threat diff --git a/detections/application/path_traversal_spl_injection.yml b/detections/application/path_traversal_spl_injection.yml new file mode 100644 index 0000000000..1aeb71ee52 --- /dev/null +++ b/detections/application/path_traversal_spl_injection.yml @@ -0,0 +1,53 @@ +name: Path traversal SPL injection +id: dfe55688-82ed-4d24-a21b-ed8f0e0fda99 +version: 1 +date: '2022-04-29' +author: Rod Soto, Splunk +type: TTP +datamodel: [] +search: ' `path_traversal_spl_injection` |search= "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by s status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`' +description: On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. +known_false_positives: This search may find additional path traversal exploitation attempts. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-26889 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt + impact: 50 + kill_chain_phases: + - Exploitation + message: Path traversal exploitation attempt from $clientip$ + mitre_attack_id: + - T1083 + observable: + - name: clientip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - source + - s + - status + - clientip + - method + - uri_path + - uri_query + risk_score: 40 + security_domain: threat diff --git a/detections/application/splunk_xss_in_monitoring_console.yml b/detections/application/splunk_xss_in_monitoring_console.yml index a1e5aa0173..c436434ba6 100644 --- a/detections/application/splunk_xss_in_monitoring_console.yml +++ b/detections/application/splunk_xss_in_monitoring_console.yml @@ -7,15 +7,15 @@ type: TTP datamodel: [] description: On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Site Scripting (XSS) vulnerability stemming from the lack of input validation in the Distributed Monitoring Console app. This detection will alert on attempted exploitation in patched versions of Splunk as well as actual exploitation in unpatched version of Splunk. search: ' `splunkd_web` method="GET" uri_query="description=%3C*" | table _time host status clientip user uri | `splunk_xss_in_monitoring_console_filter`' -how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. -known_false_positives: Use of the monitoring console where the less-than sign (<) is the first character in the description field. +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. +known_false_positives: Use of the monitoring console where the less-than sign (<) is the first character in the description field. references: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - cve: + cve: - CVE-2022-27183 cis20: - CIS 3 @@ -44,7 +44,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - method + - method - uri_query - status - clientip diff --git a/macros/local_privesc_nodejs_splunk.yml b/macros/local_privesc_nodejs_splunk.yml new file mode 100644 index 0000000000..c445d08797 --- /dev/null +++ b/macros/local_privesc_nodejs_splunk.yml @@ -0,0 +1,4 @@ +definition: index=_audit sourcetype=audittrail +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: local_privesc_nodejs_splunk diff --git a/macros/path_traversal_spl_injection.yml b/macros/path_traversal_spl_injection.yml new file mode 100644 index 0000000000..b894dc107f --- /dev/null +++ b/macros/path_traversal_spl_injection.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunkd_ui_access source="c:\\opt\\splunk\\var\\log\\splunk\\splunkd_ui_access.log" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: path_traversal_spl_injection diff --git a/tests/application/local_privesc_via_nodejs_default_path.test.yml b/tests/application/local_privesc_via_nodejs_default_path.test.yml new file mode 100644 index 0000000000..42e848ba06 --- /dev/null +++ b/tests/application/local_privesc_via_nodejs_default_path.test.yml @@ -0,0 +1,12 @@ +name: Local privesc via nodejs default path Unit Test +tests: +- name: Local privesc via nodejs default path + file: application/local_privesc_via_nodejs_default_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: local_privesc_via_nodes_default_path.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/local_privesc_via_nodes_default_path.txt + source: audittrail + sourcetype: audittrail diff --git a/tests/application/path_traversal_spl_injection.test.yml b/tests/application/path_traversal_spl_injection.test.yml new file mode 100644 index 0000000000..f40d6cd7db --- /dev/null +++ b/tests/application/path_traversal_spl_injection.test.yml @@ -0,0 +1,12 @@ +name: Path traversal SPL injection Unit Test +tests: +- name: Path traversal SPL injection + file: application/path_traversal_spl_injection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: path_traversal_spl_injection.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt + source: c:\opt\splunk\var\log\splunk\splunkd_ui_access.log + sourcetype: splunkd_ui_access From 5b59b4cf500fcfc0296060885e4c580794db04bd Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 29 Apr 2022 15:03:37 -0700 Subject: [PATCH 05/12] changedateindes --- .../application/local_privesc_via_nodejs_default_path.yml | 2 +- detections/application/path_traversal_spl_injection.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/local_privesc_via_nodejs_default_path.yml b/detections/application/local_privesc_via_nodejs_default_path.yml index 21dc5dd6d3..e280a09049 100644 --- a/detections/application/local_privesc_via_nodejs_default_path.yml +++ b/detections/application/local_privesc_via_nodejs_default_path.yml @@ -5,7 +5,7 @@ date: '2022-04-29' author: Rod Soto, Splunk type: TTP datamodel: [] -description: On May 3rd, 2022, Splunk published a security advisory for a privilege escalation vulnerability via Nodejs Default path. This vulnerability affects Windows and Unix based systems, and it allows a local low privilege user to gain SYSTEM in windows systems and in Unix based system the impact is lower as standard users cannot write under /opt directory. +description: On May, 2022, Splunk published a security advisory for a privilege escalation vulnerability via Nodejs Default path. This vulnerability affects Windows and Unix based systems, and it allows a local low privilege user to gain SYSTEM in windows systems and in Unix based system the impact is lower as standard users cannot write under /opt directory. search: '`local_privesc_nodejs_splunk` search= makeresults | eval t= printf(\"*\") roles=user provenance=UI:Dashboard:* | stats count by action user savedsearch_name search | `local_privesc_via_nodejs_default_path_filter`' how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search will provide users executing potentially exploitable command functionat search function. known_false_positives: In addition to the above search, the following search 'index=_internal pdf source="c:\\opt\\splunk\\var\\log\\splunk\\pdfgen.log" | table splunk_server filename date_mday date_hour' will provide time and document exported to PDF in order to find out low privilege user executing vulnerable function plus the export to PDF to complete exploit. diff --git a/detections/application/path_traversal_spl_injection.yml b/detections/application/path_traversal_spl_injection.yml index 1aeb71ee52..2fa47819b6 100644 --- a/detections/application/path_traversal_spl_injection.yml +++ b/detections/application/path_traversal_spl_injection.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: TTP datamodel: [] search: ' `path_traversal_spl_injection` |search= "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by s status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`' -description: On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. +description: On May, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. known_false_positives: This search may find additional path traversal exploitation attempts. references: From 80e87b95d913c456a52f5b62b2c4a6b443d5bada Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 2 May 2022 09:50:39 -0500 Subject: [PATCH 06/12] Dates & Refs --- .../application/local_privesc_via_nodejs_default_path.yml | 4 ++-- detections/application/path_traversal_spl_injection.yml | 4 ++-- detections/application/splunk_user_enumeration_attempt.yml | 2 +- detections/application/splunk_xss_in_monitoring_console.yml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/application/local_privesc_via_nodejs_default_path.yml b/detections/application/local_privesc_via_nodejs_default_path.yml index e280a09049..d494ae18c3 100644 --- a/detections/application/local_privesc_via_nodejs_default_path.yml +++ b/detections/application/local_privesc_via_nodejs_default_path.yml @@ -5,12 +5,12 @@ date: '2022-04-29' author: Rod Soto, Splunk type: TTP datamodel: [] -description: On May, 2022, Splunk published a security advisory for a privilege escalation vulnerability via Nodejs Default path. This vulnerability affects Windows and Unix based systems, and it allows a local low privilege user to gain SYSTEM in windows systems and in Unix based system the impact is lower as standard users cannot write under /opt directory. +description: On May 3rd, 2022, Splunk published a security advisory for a privilege escalation vulnerability via Nodejs Default path. This vulnerability affects Windows and Unix based systems, and it allows a local low privilege user to gain SYSTEM in windows systems and in Unix based system the impact is lower as standard users cannot write under /opt directory. search: '`local_privesc_nodejs_splunk` search= makeresults | eval t= printf(\"*\") roles=user provenance=UI:Dashboard:* | stats count by action user savedsearch_name search | `local_privesc_via_nodejs_default_path_filter`' how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search will provide users executing potentially exploitable command functionat search function. known_false_positives: In addition to the above search, the following search 'index=_internal pdf source="c:\\opt\\splunk\\var\\log\\splunk\\pdfgen.log" | table splunk_server filename date_mday date_hour' will provide time and document exported to PDF in order to find out low privilege user executing vulnerable function plus the export to PDF to complete exploit. references: - - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0501.html tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/path_traversal_spl_injection.yml b/detections/application/path_traversal_spl_injection.yml index 2fa47819b6..32a8e2ff80 100644 --- a/detections/application/path_traversal_spl_injection.yml +++ b/detections/application/path_traversal_spl_injection.yml @@ -6,11 +6,11 @@ author: Rod Soto, Splunk type: TTP datamodel: [] search: ' `path_traversal_spl_injection` |search= "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by s status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`' -description: On May, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. +description: On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. known_false_positives: This search may find additional path traversal exploitation attempts. references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_user_enumeration_attempt.yml b/detections/application/splunk_user_enumeration_attempt.yml index 15777925b2..fe23c4ab3f 100644 --- a/detections/application/splunk_user_enumeration_attempt.yml +++ b/detections/application/splunk_user_enumeration_attempt.yml @@ -10,7 +10,7 @@ search: ' `splunkd_failed_auths` | stats count(user) as auths by user, src | whe how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames. known_false_positives: Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives. references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0303.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_xss_in_monitoring_console.yml b/detections/application/splunk_xss_in_monitoring_console.yml index c436434ba6..75caa287e1 100644 --- a/detections/application/splunk_xss_in_monitoring_console.yml +++ b/detections/application/splunk_xss_in_monitoring_console.yml @@ -10,7 +10,7 @@ search: ' `splunkd_web` method="GET" uri_query="description=%3C*" | table _time how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. known_false_positives: Use of the monitoring console where the less-than sign (<) is the first character in the description field. references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0306.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html tags: analytic_story: - Splunk Vulnerabilities From 9c080cf54c32167af658e211bac791683cb92458 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 2 May 2022 10:25:04 -0500 Subject: [PATCH 07/12] Updated story --- stories/splunk_vulnerabilities.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/stories/splunk_vulnerabilities.yml b/stories/splunk_vulnerabilities.yml index 9e3d64107f..10d8bb5841 100644 --- a/stories/splunk_vulnerabilities.yml +++ b/stories/splunk_vulnerabilities.yml @@ -6,8 +6,7 @@ author: Lou Stella, Splunk description: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. narrative: This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html -- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3422 +- https://www.splunk.com/en_us/product-security/announcements.html tags: analytic_story: Splunk Vulnerabilities category: From 6fe602533bfc3f2c29b3a582b315d1e01fb99a90 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 2 May 2022 14:30:43 -0500 Subject: [PATCH 08/12] Removed detection --- .../local_privesc_via_nodejs_default_path.yml | 49 ------------------- macros/local_privesc_nodejs_splunk.yml | 4 -- ...l_privesc_via_nodejs_default_path.test.yml | 12 ----- 3 files changed, 65 deletions(-) delete mode 100644 detections/application/local_privesc_via_nodejs_default_path.yml delete mode 100644 macros/local_privesc_nodejs_splunk.yml delete mode 100644 tests/application/local_privesc_via_nodejs_default_path.test.yml diff --git a/detections/application/local_privesc_via_nodejs_default_path.yml b/detections/application/local_privesc_via_nodejs_default_path.yml deleted file mode 100644 index d494ae18c3..0000000000 --- a/detections/application/local_privesc_via_nodejs_default_path.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Local privesc via nodejs default path -id: b2d7bdef-3650-415e-a4f7-85e6d6829472 -version: 1 -date: '2022-04-29' -author: Rod Soto, Splunk -type: TTP -datamodel: [] -description: On May 3rd, 2022, Splunk published a security advisory for a privilege escalation vulnerability via Nodejs Default path. This vulnerability affects Windows and Unix based systems, and it allows a local low privilege user to gain SYSTEM in windows systems and in Unix based system the impact is lower as standard users cannot write under /opt directory. -search: '`local_privesc_nodejs_splunk` search= makeresults | eval t= printf(\"*\") roles=user provenance=UI:Dashboard:* | stats count by action user savedsearch_name search | `local_privesc_via_nodejs_default_path_filter`' -how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search will provide users executing potentially exploitable command functionat search function. -known_false_positives: In addition to the above search, the following search 'index=_internal pdf source="c:\\opt\\splunk\\var\\log\\splunk\\pdfgen.log" | table splunk_server filename date_mday date_hour' will provide time and document exported to PDF in order to find out low privilege user executing vulnerable function plus the export to PDF to complete exploit. -references: - - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0501.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - cve: - - CVE-2021-42743 - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 80 - context: - - Source:Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/local_privesc_via_nodes_default_path.txt - impact: 50 - kill_chain_phases: - - Exploitation - message: A potential exploitable function has been executed by $user$ - mitre_attack_id: - - T1548 - observable: - - name: user - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - search - - roles - - provenance - risk_score: 40 - security_domain: threat diff --git a/macros/local_privesc_nodejs_splunk.yml b/macros/local_privesc_nodejs_splunk.yml deleted file mode 100644 index c445d08797..0000000000 --- a/macros/local_privesc_nodejs_splunk.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_audit sourcetype=audittrail -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: local_privesc_nodejs_splunk diff --git a/tests/application/local_privesc_via_nodejs_default_path.test.yml b/tests/application/local_privesc_via_nodejs_default_path.test.yml deleted file mode 100644 index 42e848ba06..0000000000 --- a/tests/application/local_privesc_via_nodejs_default_path.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Local privesc via nodejs default path Unit Test -tests: -- name: Local privesc via nodejs default path - file: application/local_privesc_via_nodejs_default_path.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: local_privesc_via_nodes_default_path.txt - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/local_privesc_via_nodes_default_path.txt - source: audittrail - sourcetype: audittrail From 9fb143905984f5058963942f24a18ce752a346ac Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 2 May 2022 14:34:06 -0500 Subject: [PATCH 09/12] Adding node.exe as an app not allowed to spawn cmd.exe --- lookups/prohibited_apps_launching_cmd.csv | 1 + 1 file changed, 1 insertion(+) diff --git a/lookups/prohibited_apps_launching_cmd.csv b/lookups/prohibited_apps_launching_cmd.csv index 5e4a2cf651..7ebd89b2b4 100644 --- a/lookups/prohibited_apps_launching_cmd.csv +++ b/lookups/prohibited_apps_launching_cmd.csv @@ -15,3 +15,4 @@ java.exe,prohibited powershell.exe,prohibited mshta.exe, prohibited zoom.exe,prohibitied +node.exe,prohibited From 24486a0d8d02d943ce00fc083fcc3a09bfea34f7 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 2 May 2022 15:08:10 -0500 Subject: [PATCH 10/12] Cleaned up macro --- macros/path_traversal_spl_injection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/path_traversal_spl_injection.yml b/macros/path_traversal_spl_injection.yml index b894dc107f..e4c4154139 100644 --- a/macros/path_traversal_spl_injection.yml +++ b/macros/path_traversal_spl_injection.yml @@ -1,4 +1,4 @@ -definition: index=_internal sourcetype=splunkd_ui_access source="c:\\opt\\splunk\\var\\log\\splunk\\splunkd_ui_access.log" +definition: index=_internal sourcetype=splunkd_ui_access description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: path_traversal_spl_injection From 3f7fdbb0dd2406a8e21e9c37b00a8f5910703d8e Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 2 May 2022 15:15:47 -0500 Subject: [PATCH 11/12] Cleaned up search --- detections/application/path_traversal_spl_injection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/path_traversal_spl_injection.yml b/detections/application/path_traversal_spl_injection.yml index 32a8e2ff80..7a2716dc58 100644 --- a/detections/application/path_traversal_spl_injection.yml +++ b/detections/application/path_traversal_spl_injection.yml @@ -5,7 +5,7 @@ date: '2022-04-29' author: Rod Soto, Splunk type: TTP datamodel: [] -search: ' `path_traversal_spl_injection` |search= "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by s status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`' +search: ' `path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`' description: On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries. how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. known_false_positives: This search may find additional path traversal exploitation attempts. From eff1576b4bbd400cfbec9cdc4ac3d35a17344bfc Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 2 May 2022 15:22:41 -0500 Subject: [PATCH 12/12] Required Fields --- detections/application/path_traversal_spl_injection.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/detections/application/path_traversal_spl_injection.yml b/detections/application/path_traversal_spl_injection.yml index 7a2716dc58..94109fdec1 100644 --- a/detections/application/path_traversal_spl_injection.yml +++ b/detections/application/path_traversal_spl_injection.yml @@ -42,8 +42,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - source - - s - status - clientip - method