Merge pull request #3023 from splunk/gitlab_release_v4.35.0

Release v4.35.0
2026-06-08 17:32:49 +00:00 · 2024-07-01 08:32:26 -10:00
parent 3e64dfb5f2 fb20d895a8
commit fb7346fbae
88 changed files with 1486 additions and 143 deletions
@@ -22,7 +22,13 @@
  <row>
    <panel>
      <html>
-        <h2 style="color:red">Explore the Analytic Stories included with Splunk Security via <a href="https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html">ES Use Case Library</a> or <a href="https://splunkbase.splunk.com/app/3435/">Splunk Security Essentials</a>.</h2>
+        <div style="background-color: #f8d7da; border: 1px solid #f5c6cb; border-radius: 5px; padding: 15px; margin-bottom: 20px;">
+          <h2 style="color: #721c24; margin: 0;">
+            <i class="icon-info-circle" style="margin-right: 10px;"></i>
+            Explore Splunk Security Content using 
+            <a href="/app/SplunkEnterpriseSecuritySuite/ess_use_case_library" style="color: #721c24; text-decoration: underline;">Splunk Enterprise Security</a>
+          </h2>
+        </div>
      </html>
    </panel>
  </row>
@@ -3,7 +3,7 @@ app:
  uid: 3449
  title: ES Content Updates
  appid: DA-ESS-ContentUpdate
-  version: 4.34.0
+  version: 4.35.0
  description: Explore the Analytic Stories included with ES Content Updates.
  prefix: ESCU
  label: ESCU
@@ -1,7 +1,7 @@
-name: Splunk csrf in the ssg kvstore client endpoint
+name: Splunk CSRF in the SSG kvstore Client Endpoint
 id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410
-version: 2
-date: '2024-05-11'
+version: 3
+date: '2024-07-01'
 author: Rod Soto
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies attempts to exploit a cross-site
  information, compromising the integrity and security of the Splunk environment.
 data_source:
 - Splunk
-search: '`splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET"
+search: '`splunkda` uri_path="/*/splunkd/__raw/services/ssg/kvstore_client" method="GET"
  delete_field_value="spacebridge_server" status="200"  | table splunk_server status
  uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`'
 how_to_implement: Requires access to internal index.
@@ -24,7 +24,7 @@ known_false_positives: This hunting search only applies to the affected versions
  it requires manual investigation after executing search. This search will produce
  false positives.
 references:
- https://www.splunk.com/en_us/product-security.html
+- https://advisory.splunk.com/advisories/SVD-2023-0212
 tags:
  analytic_story:
  - Splunk Vulnerabilities
@@ -0,0 +1,56 @@
+name: Splunk DoS via POST Request Datamodel Endpoint
+id: 45766810-dbb2-44d4-b889-b4ba3ee0d1f5
+version: 1
+status: production
+date: '2024-07-01'
+author: Rod Soto
+type: Hunting
+data_source: []
+description: The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint.
+search: >-
+  `splunkd_webs` log_level=INFO message="ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('127.0.0.1', 8065)) shut down" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server message 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `splunk_dos_via_post_request_datamodel_endpoint_filter`
+how_to_implement: Need access to the internal indexes.
+known_false_positives: This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs. 
+references:
+- https://advisory.splunk.com/advisories/SVD-2024-0710
+cve:
+- CVE-2024-36986
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: Possible Denial of Service attack against $splunk_server$
+  mitre_attack_id:
+  - T1499
+  nist:
+  - DE.CM
+  observable:
+  - name: splunk_server
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - UPDATE
+  risk_score: 15
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0710_web_service_splunk_web_service.log
+    source: /opt/splunk/var/log/splunk/web_service.log
+    sourcetype: splunk_web_service
+    custom_index: _internal
@@ -1,7 +1,7 @@
 name: Splunk Enterprise Windows Deserialization File Partition
 id: 947d4d2e-1b64-41fc-b32a-736ddb88ce97
-version: 2
-date: '2024-05-18'
+version: 3
+date: '2024-07-01'
 author: Rod Soto, Eric McGinnis, Chase Franklin
 status: production
 type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies attempts to exploit a deserializa
  If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary
  code, and potentially compromise the entire Splunk environment, leading to data
  breaches and further system exploitation.
-search: '`splunk_python` request_path="/en-US/app/search/C:\\Program" *strings* |
+search: '`splunk_python` request_path="/*/app/search/C:\\Program" *strings* |
  rex "request_path=(?<file_path>[^\"]+)" | rex field=file_path "[^\"]+/(?<file_name>[^\"\''\s/\\\\]+)"
  | stats min(_time) as firstTime max(_time) as lastTime values(file_path) as file_path
  values(file_name) as file_name by index, sourcetype, host | `security_content_ctime(firstTime)`
@@ -0,0 +1,60 @@
+name: Splunk Information Disclosure on Account Login
+id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c
+version: 1
+date: '2024-07-01'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- Splunk
+description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server. 
+search: '`splunkd` component=UiAuth status=failure action=login TcpChannelThread 
+  | stats count min(_time) as firstTime max(_time) as lastTime by user status action clientip 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `splunk_information_disclosure_on_account_login_filter`'
+how_to_implement: Requires access to internal indexes _internal.
+known_false_positives: This is a hunting search and requires operator to search for large number of login failures from several users indicating possible user enumeration attempts. May capture genuine login failures. 
+references:
+- https://advisory.splunk.com/SVD-2024-0716
+cve:
+- CVE-2024-36996
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  impact: 10
+  kill_chain_phases:
+  - Exploitation
+  message: Possible user enumeration attack against $clientip$
+  mitre_attack_id:
+  - T1087
+  nist:
+  - DE.CM
+  observable:
+  - name: clientip
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - user
+  - action
+  - status 
+  - clientip 
+  - host 
+  risk_score: 5
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/splunk/SVD-2024-0716_splunkd_splunkd.log
+    source: /opt/splunk/var/log/splunk/splunkd.log
+    sourcetype: splunkd
+    custom_index: _internal 
@@ -0,0 +1,57 @@
+name: Splunk RCE PDFgen Render
+id: bc2b7437-0400-438b-9537-21ab5b7d2d53
+version: 1
+date: '2024-07-01'
+status: production
+author: Rod Soto, Chase Franklin
+type: TTP
+data_source:
+- Splunk
+description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote 
+search: 'index=_internal sourcetype=splunk_pdfgen _raw IN ("*base64*", "*lambda*", "*system*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host, _raw
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `splunk_rce_pdfgen_render_filter`'
+how_to_implement: Requires access to internal indexes. 
+known_false_positives: This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives. 
+references:
+- https://advisory.splunk.com/advisories/SVD-2024-0701
+cve:
+- CVE-2024-36982
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: Possible exploitation against $host$
+  mitre_attack_id:
+  - T1210
+  nist:
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - host
+  risk_score: 80
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0701_pdfgen_log_splunk_pdfgen.log
+    source: /opt/splunk/var/log/splunk/pdfgen.log
+    sourcetype: splunk_pdfgen
+    custom_index: _internal
+
@@ -0,0 +1,56 @@
+name: Splunk RCE via External Lookup Copybuckets
+id: 8598f9de-bba8-42a4-8ef0-12e1adda4131
+version: 1
+date: '2024-07-01'
+status: production
+author: Rod Soto, Chase Franklin
+type: Hunting
+data_source:
+- Splunk
+description: The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup.
+search: 'index=_internal sourcetype="splunk_archiver-too_small" *.csv
+  | rex field=_raw "Invoking command:\s(?<command>.*)" 
+  | stats min(_time) as firstTime max(_time) as lastTime values(command) as command values(severity) as severity by host
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `splunk_rce_via_external_lookup_copybuckets_filter`'
+how_to_implement: Requires access to internal indexes
+known_false_positives: An operator must identify elements indicatives of command execution requests by looking at regex data being extracted from the log. Not all the requests will be malicious. 
+references:
+- https://advisory.splunk.com/advisories/SVD-2024-0705
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities 
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: Possible exploitation attempt against $host$
+  mitre_attack_id:
+  - T1210
+  nist:
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - host
+  risk_score: 80
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0705_splunk_archiver_splunk_archiver-too_small.log
+    source: /opt/splunk/var/log/splunk/splunk_archiver.log
+    sourcetype: splunk_archiver-too_small
+    update_timestamp: true
+    custom_index: _internal
@@ -1,7 +1,7 @@
 name: Splunk risky Command Abuse disclosed february 2023
 id: ee69374a-d27e-4136-adac-956a96ff60fd
-version: 3
-date: '2024-05-05'
+version: 4
+date: '2024-07-01'
 author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
 status: production
 type: Hunting
@@ -26,7 +26,7 @@ search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time)
 how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel.
 known_false_positives: This search encompasses many commands.
 references:
- https://www.splunk.com/en_us/product-security.html
+- https://advisory.splunk.com/advisories
 tags:
  analytic_story:
  - Splunk Vulnerabilities
@@ -43,6 +43,7 @@ tags:
  - CVE-2023-40598
  - CVE-2023-46214
  - CVE-2024-23676
+  - CVE-2024-36984
  impact: 50
  message: Use of risky splunk command $splunk_risky_command$ detected by $user$
  mitre_attack_id:
@@ -0,0 +1,57 @@
+name: Splunk Stored XSS conf-web Settings on Premises
+id: ed1209ef-228d-4dab-9856-be9369925a5c
+version: 1
+date: '2024-07-01'
+author: Rod Soto, Chase Franklin
+status: production
+type: Hunting
+data_source:
+- Splunk
+description: This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user. 
+search: '`splunk_python` *script* *eval* 
+  | stats min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `splunk_stored_xss_conf_web_settings_on_premises_filter`'
+how_to_implement: Requires access to internal indexes.
+known_false_positives: This is a hunting search and will produce false positives, operator must identify XSS elemetns in the splunk_python log related to the vulnerable endpoint. 
+references:
+- https://advisory.splunk.com/advisories/SVD-2024-0717
+cve:
+- CVE-2024-36987
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  impact: 20
+  kill_chain_phases:
+  - Exploitation
+  message: Possible XSS attack against $host$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - UPDATE
+  risk_score: 20
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0717_python_log_splunk_python.log
+    source: /opt/splunk/var/log/splunk/python.log
+    sourcetype: splunk_python
+    custom_index: _internal
+
@@ -1,7 +1,7 @@
-name: Splunk Stored XSS via Data Model objectName field
+name: Splunk Stored XSS via Data Model objectName Field
 id: 062bff76-5f9c-496e-a386-cb1adcf69871
-version: 2
-date: '2024-05-17'
+version: 3
+date: '2024-07-01'
 author: Rod Soto
 status: production
 type: Hunting
@@ -15,7 +15,7 @@ description: The following analytic identifies attempts to exploit a stored cros
  data theft, session hijacking, or further compromise of the Splunk environment.
 data_source:
 - Splunk
-search: '`splunkd_webx` uri=/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model*
+search: '`splunkd_webx` uri=/*/splunkd/__raw/servicesNS/*/launcher/datamodel/model*
  uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`'
 how_to_implement: This vulnerability only affects Splunk Web enabled instances. This
  detection does not require you to ingest any new data. The detection does require
@@ -25,7 +25,7 @@ known_false_positives: This search may produce false positives and does not cove
  against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the
  injection point.
 references:
- https://www.splunk.com/en_us/product-security.html
+- https://advisory.splunk.com/advisories/SVD-2022-1109
 - https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
 tags:
  analytic_story:
@@ -0,0 +1,62 @@
+name: Splunk Stored XSS via Specially Crafted Bulletin Message
+id: fd852b27-1882-4505-9f2c-64dfb96f4fc1
+version: 1
+date: '2024-07-01'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- Splunk
+description: The following hunting detection provides fields related to /service/messages endpoints where specially crafted bulletin message can exploit stored XSS. 
+search: '| rest /services/messages 
+  | search message="*http*"
+  | table id author message title 
+  | `splunk_stored_xss_via_specially_crafted_bulletin_message_filter`'
+how_to_implement: Need access to Splunk REST api data via search. 
+known_false_positives: Must look at messages field and find malicious suspicious characters or hyperlinks. Not all requests to this endpoint will be malicious. 
+references:
+- https://advisory.splunk.com/SVD-2024-0713
+cve:
+- CVE-2024-36993
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  impact: 10
+  kill_chain_phases:
+  - Exploitation
+  message: Please investigate $message for possible XSS attack in bulletin message $message$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - DE.CM
+  observable:
+  - name: message
+    type: Other
+    role:
+    - Other
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - table
+  - id
+  - author
+  - message 
+  - title 
+  risk_score: 5
+  security_domain: endpoint
+  manual_test: This search uses a REST call against a running Splunk instance to fetch
+    messages that have been created on the instance. It cannot be replicated with a normal test or
+    attack data as this data cannot be "replayed" into a Splunk instance.
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0713_json_json.log
+    source: _json
+    sourcetype: _json
+    custom_index: _internal
@@ -0,0 +1,56 @@
+name: Splunk Unauthenticated DoS via Null Pointer References
+id: d67594fe-c317-41b8-9319-ec8428d5c2ea
+version: 1
+date: '2024-07-01'
+author: Rod Soto
+status: production
+type: Hunting
+data_source:
+- Splunk
+description: The following hunting search provides information on splunkd crash as a result of a Denial of Service Exploitation via null pointer references which targets 'services/cluster/config' endpoint.
+search: '`splunk_crash_log` "Segmentation fault" "POST /services/cluster/config" 
+  | stats count min(_time) as firstTime max(_time) as  lastTime by host 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `splunk_unauthenticated_dos_via_null_pointer_references_filter`'
+how_to_implement: Requires access to internal indexes. 
+known_false_positives: This is a hunting search and will produce false positives. An operator needs to find proximity and detail of requests targeting cluster config endpoint and subsequent Segmentation fault in splunk crash log. 
+references:
+- https://advisory.splunk.com/advisories/SVD-2024-0702 
+cve:
+- CVE-2024-36983
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: Possible exploitation attack against $host$
+  mitre_attack_id:
+  - T1499
+  nist:
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - sourcetype
+  risk_score: 15
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0702_splunkd_crash_log_splunkd_crash_log.log
+    source: /opt/splunk/var/log/splunk/crash-*.log
+    sourcetype: splunkd_crash_log
+    custom_index: _internal
@@ -0,0 +1,57 @@
+name: Splunk Unauthenticated Path Traversal Modules Messaging
+id: e7c2b064-524e-4d65-8002-efce808567aa
+version: 1
+date: '2024-07-01'
+author: Rod Soto, Chase Franklin
+status: production
+type: Hunting
+data_source:
+- Splunk
+description: This hunting search provides information on exploitation attempts against /modules/messaging endpoint, the exploit can be clearly seen as the ../ which signals an attempt to traverse target directories.
+search: '`splunkd_web` method=GET uri_path="/*/modules/messaging/*..*" 
+  | stats min(_time) as firstTime max(_time) as lastTime values(method) as method values(uri_path) as uri_path by host 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `splunk_unauthenticated_path_traversal_modules_messaging_filter`'
+how_to_implement: Only applies to Microsoft Windows installations of Splunk.
+known_false_positives: May catch other exploitation attempts using path traversal related characters. 
+references:
+- https://advisory.splunk.com/SVD-2024-0711 
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  impact: 20
+  kill_chain_phases:
+  - Exploitation
+  message: Possible directory traversal attack against $host$
+  mitre_attack_id:
+  - T1083
+  nist:
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - method
+  - uri_path
+  - host 
+  risk_score: 20
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/SVD-2024-0711_web_access_splunk_web_access.log
+    source: C:\\Program Files\\Splunk\\var\\log\\splunk\\web_access.log
+    sourcetype: splunk_web_access
+    custom_index: _internal
+
@@ -0,0 +1,60 @@
+name: Splunk Unauthorized Experimental Items Creation
+id: 84afda04-0cd6-466b-869e-70d6407d0a34
+version: 1
+date: '2024-07-01'
+author: Rod Soto, Chase Franklin
+status: production
+type: Hunting
+data_source:
+- Splunk
+description: This hunting search provides information on finding possible creation of unauthorized items against /experimental endpoint.
+search: '`splunkda` */experimental/* method=POST
+  | stats count min(_time) as firstTime max(_time) as lastTime by clientip method uri_path uri status 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `splunk_unauthorized_experimental_items_creation_filter`'
+how_to_implement: Requires access to internal indexes. 
+known_false_positives: Not all requests are going to be malicious, there will be false positives, however operator must find suspicious items that might have been created by an unauthorized user. 
+references:
+- https://advisory.splunk.com/SVD-2024-0715
+cve:
+- CVE-2024-36995
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  impact: 5
+  kill_chain_phases:
+  - Exploitation
+  message: Possible unauthorized creation of experimental items from $clientip$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - DE.CM
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - clientip
+  - method
+  - uri_path
+  - uri 
+  - status
+  risk_score: 5
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0715_splunkd_splunkd_access.log
+    source: /opt/splunk/var/log/splunk/splunkd_access.log
+    sourcetype: splunkd_access
+    custom_index: _internal
@@ -0,0 +1,56 @@
+name: Splunk Unauthorized Notification Input by User
+id: 4b7f368f-4322-47f8-8363-2c466f0b7030
+version: 1
+date: '2024-07-01'
+author: Rod Soto
+status: experimental
+type: Hunting
+data_source:
+- Splunk
+description: This hunting search provides information to track possible exploitation of a lower privilege user able to push notifications that may include malicious code as notifications for all users in Splunk. 
+search: '| rest /services/messages | table title message severity timeCreated_iso published splunk_server author | `splunk_unauthorized_notification_input_by_user_filter`'
+how_to_implement: Requires access to Splunk rest data. 
+known_false_positives: This search will produce false positives which may include benign notifications from other Splunk entities, attention to suspicious or anomalous elements in notifications helps identify actual exploitation of this vulnerability.   
+references:
+- https://advisory.splunk.com/advisories/SVD-2024-0709
+cve:
+- CVE-2023-33733
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  impact: 20
+  kill_chain_phases:
+  - Exploitation
+  message: Please review messages at $splunk_server for possible unauthorized notification input. 
+  mitre_attack_id:
+  - T1548
+  nist:
+  - DE.CM
+  observable:
+  - name: splunk_server
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - message
+  - title
+  - splunk_server
+  - author
+  risk_score: 12
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/SVD-2024-0709_json_json.json
+    source: _json
+    sourcetype: _json
+    custom_index: _internal
+
@@ -1,7 +1,7 @@
 name: Splunk XSS in Highlighted JSON Events
 id: 1030bc63-0b37-4ac9-9ae0-9361c955a3cc
-version: 2
-date: '2024-05-28'
+version: 3
+date: '2024-07-01'
 author: Rod Soto, Splunk
 status: production
 type: Hunting
@@ -15,7 +15,7 @@ description: The following analytic identifies potential exploitation of a Cross
  to execute arbitrary JavaScript, potentially accessing the API with the logged-in
  user's permissions. If the user is an admin, the attacker could create an admin
  account, leading to full control over the Splunk environment.
-search: '`splunkd_ui` "/en-US/splunkd/__raw/servicesNS/nobody/search/authentication/users"
+search: '`splunkd_ui` "/*/splunkd/__raw/servicesNS/nobody/search/authentication/users"
  status=201 | stats count min(_time) as firstTime max(_time) as lastTime by clientip,
  uri_path, method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `splunk_xss_in_highlighted_json_events_filter`'
@@ -26,7 +26,7 @@ known_false_positives: This is a hunting search and will produce false positives
  resulting from a potential exploitation payload (the creation of a user with admin
  privileges).
 references:
- https://advisory.splunk.com/advisories
+- https://advisory.splunk.com/advisories/SVD-2023-1103
 cve:
 - CVE-2023-46213
 tags:
@@ -1,7 +1,7 @@
 name: Splunk XSS in Save table dialog header in search page
 id: a974d1ee-ddca-4837-b6ad-d55a8a239c20
-version: 2
-date: '2024-05-27'
+version: 3
+date: '2024-07-01'
 author: Rod Soto
 status: production
 type: Hunting
@@ -15,7 +15,7 @@ description: The following analytic identifies persistent cross-site scripting (
  theft, session hijacking, or further exploitation within the Splunk environment.
 data_source:
 - Splunk
-search: '`splunkd_webx` method=POST  uri=/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model
+search: '`splunkd_webx` method=POST  uri=/*/splunkd/__raw/servicesNS/nobody/search/datamodel/model
  | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`'
 how_to_implement: Watch for POST requests combined with XSS script strings or obfuscation
  against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model.
@@ -24,7 +24,7 @@ known_false_positives: If host is vulnerable and XSS script strings are inputted
  users create and save dashboards. This search may produce several results with non
  malicious POST requests. Only affects Splunk Web enabled instances.
 references:
- https://www.splunk.com/en_us/product-security.html
+- https://advisory.splunk.com/advisories/SVD-2022-1101
 - https://portswigger.net/web-security/cross-site-scripting
 tags:
  analytic_story:
@@ -0,0 +1,72 @@
+name: Splunk XSS Privilege Escalation via Custom Urls in Dashboard
+id: 01e1e386-7656-4f36-a55a-52fe39b04a96
+version: 1
+date: '2024-07-01'
+author: Rod Soto, Chase Franklin
+status: production
+type: Hunting
+data_source:
+- Splunk
+description: This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges. 
+search: '`splunkd_ui` method=POST /*/data/ui/views* 
+  | stats values(method) as method by _time index, sourcetype, host 
+  | eval event="post_request" 
+  | append 
+      [| search `audittrail` action="edit_user" operation="create" 
+      | rex field=_raw "object=\"(?<newUser>.*)\"" 
+      | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser 
+      | eval event="create_user"] 
+  | sort - _time 
+  | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m
+  | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount
+  | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`'
+how_to_implement: Requires access to internal indexes _audit and _internal.
+known_false_positives: This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime. 
+references:
+- https://advisory.splunk.com/
+cve:
+- CVE-2024-36992
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  impact: 10
+  kill_chain_phases:
+  - Exploitation
+  message: Possible XSS attack and privilege escalation via custom urls in dashboard against $host$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - method
+  - host
+  - action
+  - operation
+  - splunk_server
+  - user
+  risk_score: 5
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_splunkd_ui_access_splunk_ui_access.log
+    source: /opt/splunk/var/log/splunk/splunkd_ui_access.log
+    sourcetype: splunkd_ui_access 
+    custom_index: _internal 
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_audittrail_audittrail.log
+    source: /opt/splunk/var/log/splunk/audittrail 
+    sourcetype: audittrail
+    custom_index: _audit 
@@ -0,0 +1,60 @@
+name: Splunk XSS Via External Urls in Dashboards SSRF
+id: b0a67520-ae82-4cf6-b04e-9f6cce56830d
+version: 1
+date: '2024-07-01'
+author: Rod Soto, Chase Franklin
+status: production
+type: Hunting
+data_source:
+- Splunk
+description: This is a hunting search that provides elements to find possible dashboards created with external URL references in order to elicit Server Side Request Forgery from /data/ui/views endpoint. 
+search: '`splunkd_web` user=* uri_path="/*/manager/permissions/launcher/data/ui/views/*" file=* 
+  | stats count min(_time) as firstTime max(_time) as lastTime by clientip user file host method uri_path uri_query
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `splunk_xss_via_external_urls_in_dashboards_ssrf_filter`'
+how_to_implement: Requires access to internal indexes.
+known_false_positives: This is a hunting search and requires an operator to search for specific indicators of Server Side Request Forgery attack against /data/ui/views. 
+  It is not possible to grab display the payloads of such requests, so this search provides users, ip addresses, requests, files, and queries that may indicate malicious intent. There will be false positives. 
+references:
+- https://advisory.splunk.com/SVD-2024-0714 
+cve:
+- CVE-2024-36994
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Splunk Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  impact: 10
+  kill_chain_phases:
+  - Exploitation
+  message: Possible SSRF attack from $clientip$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - DE.CM
+  observable:
+  - name: clientip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  required_fields:
+  - uri_path
+  - user 
+  - file 
+  - clientip 
+  risk_score: 5
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0714_web_access_splunk_web_access.log
+    source: /opt/splunk/var/log/splunk/web_access.log
+    sourcetype: splunk_web_access
+    custom_index: _internal
@@ -1,7 +1,7 @@
 name: Cloud Compute Instance Created By Previously Unseen User
 id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
 version: 3
-date: '2025-05-18'
+date: '2024-05-18'
 author: Rico Valdez, Splunk
 status: experimental
 type: Anomaly
@@ -1,7 +1,7 @@
 name: Detect Excessive User Account Lockouts
 id: 95a7f9a5-6096-437e-a19e-86f42ac609bd
 version: 6
-date: '2025-05-20'
+date: '2024-05-20'
 author: David Dorsey, Splunk
 status: production
 type: Anomaly
@@ -1,7 +1,7 @@
 name: Windows Create Local Account
 id: 3fb2e8e3-7bc0-4567-9722-c5ab9f8595eb
 version: 3
-date: '2025-05-19'
+date: '2024-05-19'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS-ContentUpdate", 
-      "version": "4.34.0"
+      "version": "4.35.0"
    }, 
    "author": [
      {
@@ -14,7 +14,7 @@
        "company": "Splunk"
      }
    ], 
-    "releaseDate": "2024-06-26", 
+    "releaseDate": "2024-07-01", 
    "description": "Explore the Analytic Stories included with ES Content Updates.", 
    "classification": {
      "intendedAudience": null, 
@@ -1,7 +1,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -420,7 +420,7 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitr
 known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
 providing_technologies = null

-[savedsearch://ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule]
+[savedsearch://ESCU - Splunk CSRF in the SSG kvstore Client Endpoint - Rule]
 type = detection
 asset_type = Endpoint
 confidence = medium
@@ -490,6 +490,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = None.
 providing_technologies = null

+[savedsearch://ESCU - Splunk DoS via POST Request Datamodel Endpoint - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint.
+how_to_implement = Need access to the internal indexes.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499"], "nist": ["DE.AE"]}
+known_false_positives = This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs.
+providing_technologies = ["Splunk Internal Logs"]
+
 [savedsearch://ESCU - Splunk DOS via printf search function - Rule]
 type = detection
 asset_type = Endpoint
@@ -590,6 +600,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = This search is highly specific for vulnerable versions of Splunk Add-on Builder. There are no known false positives.
 providing_technologies = null

+[savedsearch://ESCU - Splunk Information Disclosure on Account Login - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server.
+how_to_implement = Requires access to internal indexes _internal.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "nist": ["DE.AE"]}
+known_false_positives = This is a hunting search and requires operator to search for large number of login failures from several users indicating possible user enumeration attempts. May capture genuine login failures.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk list all nonstandard admin accounts - Rule]
 type = detection
 asset_type = Endpoint
@@ -680,6 +700,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = This is a hunting search which provides verbose results against this endpoint. Operator must consider things such as IP address, useragent and user(specially low privelege) and host to investigate possible attack.
 providing_technologies = null

+[savedsearch://ESCU - Splunk RCE PDFgen Render - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote
+how_to_implement = Requires access to internal indexes.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.CM"]}
+known_false_positives = This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk RCE via External Lookup Copybuckets - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup.
+how_to_implement = Requires access to internal indexes
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"]}
+known_false_positives = An operator must identify elements indicatives of command execution requests by looking at regex data being extracted from the log. Not all the requests will be malicious.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk RCE via Serialized Session Payload - Rule]
 type = detection
 asset_type = Endpoint
@@ -740,7 +780,17 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = This search encompasses many commands.
 providing_technologies = null

-[savedsearch://ESCU - Splunk Stored XSS via Data Model objectName field - Rule]
+[savedsearch://ESCU - Splunk Stored XSS conf-web Settings on Premises - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user.
+how_to_implement = Requires access to internal indexes.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+known_false_positives = This is a hunting search and will produce false positives, operator must identify XSS elemetns in the splunk_python log related to the vulnerable endpoint.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk Stored XSS via Data Model objectName Field - Rule]
 type = detection
 asset_type = Endpoint
 confidence = medium
@@ -750,6 +800,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
 known_false_positives = This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point.
 providing_technologies = ["Splunk Internal Logs"]

+[savedsearch://ESCU - Splunk Stored XSS via Specially Crafted Bulletin Message - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = The following hunting detection provides fields related to /service/messages endpoints where specially crafted bulletin message can exploit stored XSS.
+how_to_implement = Need access to Splunk REST api data via search.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+known_false_positives = Must look at messages field and find malicious suspicious characters or hyperlinks. Not all requests to this endpoint will be malicious.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk Unauthenticated DoS via Null Pointer References - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = The following hunting search provides information on splunkd crash as a result of a Denial of Service Exploitation via null pointer references which targets 'services/cluster/config' endpoint.
+how_to_implement = Requires access to internal indexes.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499"], "nist": ["DE.AE"]}
+known_false_positives = This is a hunting search and will produce false positives. An operator needs to find proximity and detail of requests targeting cluster config endpoint and subsequent Segmentation fault in splunk crash log.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk Unauthenticated Log Injection Web Service Log - Rule]
 type = detection
 asset_type = Endpoint
@@ -760,6 +830,36 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
 known_false_positives = This hunting search will produce false positives if ANSI escape characters are included in URLs either voluntarily or by accident. This search will not detect obfuscated ANSI characters.
 providing_technologies = ["Splunk Internal Logs"]

+[savedsearch://ESCU - Splunk Unauthenticated Path Traversal Modules Messaging - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = This hunting search provides information on exploitation attempts against /modules/messaging endpoint, the exploit can be clearly seen as the ../ which signals an attempt to traverse target directories.
+how_to_implement = Only applies to Microsoft Windows installations of Splunk.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"]}
+known_false_positives = May catch other exploitation attempts using path traversal related characters.
+providing_technologies = ["Splunk Internal Logs"]
+
+[savedsearch://ESCU - Splunk Unauthorized Experimental Items Creation - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = This hunting search provides information on finding possible creation of unauthorized items against /experimental endpoint.
+how_to_implement = Requires access to internal indexes.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+known_false_positives = Not all requests are going to be malicious, there will be false positives, however operator must find suspicious items that might have been created by an unauthorized user.
+providing_technologies = null
+
+[savedsearch://ESCU - Splunk Unauthorized Notification Input by User - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = This hunting search provides information to track possible exploitation of a lower privilege user able to push notifications that may include malicious code as notifications for all users in Splunk.
+how_to_implement = Requires access to Splunk rest data.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"]}
+known_false_positives = This search will produce false positives which may include benign notifications from other Splunk entities, attention to suspicious or anomalous elements in notifications helps identify actual exploitation of this vulnerability.
+providing_technologies = null
+
 [savedsearch://ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule]
 type = detection
 asset_type = Endpoint
@@ -810,6 +910,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
 known_false_positives = If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances.
 providing_technologies = ["Splunk Internal Logs"]

+[savedsearch://ESCU - Splunk XSS Privilege Escalation via Custom Urls in Dashboard - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges.
+how_to_implement = Requires access to internal indexes _audit and _internal.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+known_false_positives = This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime.
+providing_technologies = ["Splunk Internal Logs"]
+
+[savedsearch://ESCU - Splunk XSS Via External Urls in Dashboards SSRF - Rule]
+type = detection
+asset_type = Splunk Server
+confidence = medium
+explanation = This is a hunting search that provides elements to find possible dashboards created with external URL references in order to elicit Server Side Request Forgery from /data/ui/views endpoint.
+how_to_implement = Requires access to internal indexes.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+known_false_positives = This is a hunting search and requires an operator to search for specific indicators of Server Side Request Forgery attack against /data/ui/views. It is not possible to grab display the payloads of such requests, so this search provides users, ip addresses, requests, files, and queries that may indicate malicious intent. There will be false positives.
+providing_technologies = ["Splunk Internal Logs"]
+
 [savedsearch://ESCU - Splunk XSS via View - Rule]
 type = detection
 asset_type = Endpoint
@@ -18767,7 +18887,7 @@ version = 1
 references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
 maintainers = [{"company": "Rod Soto, Eric McGinnis, Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Absolute Path Traversal Using runshellscript - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk App for Lookup File Editing RCE via User XSLT - Rule", "ESCU - Splunk Authentication Token Exposure in Debug Log - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS Using Malformed SAML Request - Rule", "ESCU - Splunk DOS Via Dump SPL Command - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk DOS via printf search function - Rule", "ESCU - Splunk Edit User Privilege Escalation - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Enterprise KV Store Incorrect Authorization - Rule", "ESCU - Splunk Enterprise Windows Deserialization File Partition - Rule", "ESCU - Splunk ES DoS Investigations Manager via Investigation Creation - Rule", "ESCU - Splunk ES DoS Through Investigation Attachments - Rule", "ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Splunk Information Disclosure in Splunk Add-on Builder - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule", "ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule", "ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule", "ESCU - Splunk RCE via Serialized Session Payload - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk RCE via User XSLT - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk Reflected XSS on App Search Table Endpoint - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk Unauthenticated Log Injection Web Service Log - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Highlighted JSON Events - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
+searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Absolute Path Traversal Using runshellscript - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk App for Lookup File Editing RCE via User XSLT - Rule", "ESCU - Splunk Authentication Token Exposure in Debug Log - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk CSRF in the SSG kvstore Client Endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS Using Malformed SAML Request - Rule", "ESCU - Splunk DOS Via Dump SPL Command - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk DoS via POST Request Datamodel Endpoint - Rule", "ESCU - Splunk DOS via printf search function - Rule", "ESCU - Splunk Edit User Privilege Escalation - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Enterprise KV Store Incorrect Authorization - Rule", "ESCU - Splunk Enterprise Windows Deserialization File Partition - Rule", "ESCU - Splunk ES DoS Investigations Manager via Investigation Creation - Rule", "ESCU - Splunk ES DoS Through Investigation Attachments - Rule", "ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Splunk Information Disclosure in Splunk Add-on Builder - Rule", "ESCU - Splunk Information Disclosure on Account Login - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule", "ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule", "ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule", "ESCU - Splunk RCE PDFgen Render - Rule", "ESCU - Splunk RCE via External Lookup Copybuckets - Rule", "ESCU - Splunk RCE via Serialized Session Payload - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk RCE via User XSLT - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk Reflected XSS on App Search Table Endpoint - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS conf-web Settings on Premises - Rule", "ESCU - Splunk Stored XSS via Data Model objectName Field - Rule", "ESCU - Splunk Stored XSS via Specially Crafted Bulletin Message - Rule", "ESCU - Splunk Unauthenticated DoS via Null Pointer References - Rule", "ESCU - Splunk Unauthenticated Log Injection Web Service Log - Rule", "ESCU - Splunk Unauthenticated Path Traversal Modules Messaging - Rule", "ESCU - Splunk Unauthorized Experimental Items Creation - Rule", "ESCU - Splunk Unauthorized Notification Input by User - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Highlighted JSON Events - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS Privilege Escalation via Custom Urls in Dashboard - Rule", "ESCU - Splunk XSS Via External Urls in Dashboards SSRF - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
 description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
 narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.

@@ -1,7 +1,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -11,7 +11,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 20240626201627
+build = 20240701174052

 [triggers]
 reload.analytic_stories = simple
@@ -27,7 +27,7 @@ reload.es_investigations = simple

 [launcher]
 author = Splunk
-version = 4.34.0 
+version = 4.35.0 
 description = Explore the Analytic Stories included with ES Content Updates.

 [ui]
@@ -1,7 +1,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -1,9 +1,9 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 [content-version]
-version = 4.34.0 
+version = 4.35.0 
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -2,7 +2,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:59 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -22,7 +22,13 @@
  <row>
    <panel>
      <html>
-        <h2 style="color:red">Explore the Analytic Stories included with Splunk Security via <a href="https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html">ES Use Case Library</a> or <a href="https://splunkbase.splunk.com/app/3435/">Splunk Security Essentials</a>.</h2>
+        <div style="background-color: #f8d7da; border: 1px solid #f5c6cb; border-radius: 5px; padding: 15px; margin-bottom: 20px;">
+          <h2 style="color: #721c24; margin: 0;">
+            <i class="icon-info-circle" style="margin-right: 10px;"></i>
+            Explore Splunk Security Content using 
+            <a href="/app/SplunkEnterpriseSecuritySuite/ess_use_case_library" style="color: #721c24; text-decoration: underline;">Splunk Enterprise Security</a>
+          </h2>
+        </div>
      </html>
    </panel>
  </row>
@@ -1,7 +1,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -1,7 +1,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -680,6 +680,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = index=_internal sourcetype=splunk_web_access
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

+[splunkd_webs]
+definition = index=_internal sourcetype=splunk_web_service
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [splunkd_webx]
 definition = index=_internal sourcetype=splunk_web_access
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -968,6 +972,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_dos_via_post_request_datamodel_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_dos_via_printf_search_function_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1008,6 +1016,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_information_disclosure_on_account_login_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_list_all_nonstandard_admin_accounts_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1044,6 +1056,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_rce_pdfgen_render_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_rce_via_external_lookup_copybuckets_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_rce_via_serialized_session_payload_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1068,14 +1088,38 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_stored_xss_conf_web_settings_on_premises_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_stored_xss_via_data_model_objectname_field_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_stored_xss_via_specially_crafted_bulletin_message_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_unauthenticated_dos_via_null_pointer_references_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_unauthenticated_log_injection_web_service_log_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_unauthenticated_path_traversal_modules_messaging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_unauthorized_experimental_items_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_unauthorized_notification_input_by_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1096,6 +1140,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

+[splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_xss_via_external_urls_in_dashboards_ssrf_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_xss_via_view_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1,7 +1,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -1770,7 +1770,7 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`

-[ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule]
+[ESCU - Splunk CSRF in the SSG kvstore Client Endpoint - Rule]
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic identifies attempts to exploit a cross-site request forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client endpoint. It detects GET requests to the vulnerable endpoint using internal index data, focusing on specific URI paths and HTTP methods. This activity is significant because it can allow unauthorized updates to SSG KV store collections, potentially leading to data manipulation or unauthorized access. If confirmed malicious, this could enable attackers to alter critical configurations or exfiltrate sensitive information, compromising the integrity and security of the Splunk environment.
@@ -1779,10 +1779,10 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies attempts to exploit a cross-site request forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client endpoint. It detects GET requests to the vulnerable endpoint using internal index data, focusing on specific URI paths and HTTP methods. This activity is significant because it can allow unauthorized updates to SSG KV store collections, potentially leading to data manipulation or unauthorized access. If confirmed malicious, this could enable attackers to alter critical configurations or exfiltrate sensitive information, compromising the integrity and security of the Splunk environment.
 action.escu.how_to_implement = Requires access to internal index.
 action.escu.known_false_positives = This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives.
-action.escu.creation_date = 2024-05-11
-action.escu.modification_date = 2024-05-11
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
 action.escu.confidence = high
-action.escu.full_search_name = ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule
+action.escu.full_search_name = ESCU - Splunk CSRF in the SSG kvstore Client Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
@@ -1796,14 +1796,14 @@ cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule
+action.correlationsearch.label = ESCU - Splunk CSRF in the SSG kvstore Client Endpoint - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2023-22942"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "type": "TTP"}
-action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "4742d5f7-ce00-45ce-9c79-5e98b43b4410", "detection_version": "2"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "4742d5f7-ce00-45ce-9c79-5e98b43b4410", "detection_version": "3"}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
 action.notable.param.rule_description = The following analytic identifies attempts to exploit a cross-site request forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client endpoint. It detects GET requests to the vulnerable endpoint using internal index data, focusing on specific URI paths and HTTP methods. This activity is significant because it can allow unauthorized updates to SSG KV store collections, potentially leading to data manipulation or unauthorized access. If confirmed malicious, this could enable attackers to alter critical configurations or exfiltrate sensitive information, compromising the integrity and security of the Splunk environment.
-action.notable.param.rule_title = Splunk csrf in the ssg kvstore client endpoint
+action.notable.param.rule_title = Splunk CSRF in the SSG kvstore Client Endpoint
 action.notable.param.security_domain = threat
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -1815,7 +1815,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200"  | table splunk_server status uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`
+search = `splunkda` uri_path="/*/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200"  | table splunk_server status uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`

 [ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule]
 action.escu = 0
@@ -2049,6 +2049,42 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`

+[ESCU - Splunk DoS via POST Request Datamodel Endpoint - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint.
+action.escu.how_to_implement = Need access to the internal indexes.
+action.escu.known_false_positives = This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk DoS via POST Request Datamodel Endpoint - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = ["Splunk Internal Logs"]
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk DoS via POST Request Datamodel Endpoint - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "45766810-dbb2-44d4-b889-b4ba3ee0d1f5", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkd_webs` log_level=INFO message="ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('127.0.0.1', 8065)) shut down"  | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server message  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_dos_via_post_request_datamodel_endpoint_filter`
+
 [ESCU - Splunk DOS via printf search function - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2213,8 +2249,8 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies attempts to exploit a deserialization vulnerability in Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3. It detects irregular path file executions by analyzing `splunk_python` logs and extracting file paths and names. This activity is significant because it indicates potential exploitation of a known vulnerability, which could lead to arbitrary code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially compromise the entire Splunk environment, leading to data breaches and further system exploitation.
 action.escu.how_to_implement = Requires access to internal indexes. This detection search will display irregular path file execution, which will display exploit attempts. Only applies to Microsoft Windows Splunk versions.
 action.escu.known_false_positives = Irregular path with files that may be purposely called for benign reasons may produce false positives.
-action.escu.creation_date = 2024-05-18
-action.escu.modification_date = 2024-05-18
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Enterprise Windows Deserialization File Partition - Rule
 action.escu.search_type = detection
@@ -2232,7 +2268,7 @@ dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Splunk Enterprise Windows Deserialization File Partition - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2024-23678"], "impact": 100, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "type": "TTP"}
-action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "947d4d2e-1b64-41fc-b32a-736ddb88ce97", "detection_version": "2"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "947d4d2e-1b64-41fc-b32a-736ddb88ce97", "detection_version": "3"}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -2249,7 +2285,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `splunk_python` request_path="/en-US/app/search/C:\\Program" *strings* | rex "request_path=(?<file_path>[^\"]+)" | rex field=file_path "[^\"]+/(?<file_name>[^\"\'\s/\\\\]+)" | stats min(_time) as firstTime max(_time) as lastTime values(file_path) as file_path values(file_name) as file_name by index, sourcetype, host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_windows_deserialization_file_partition_filter`
+search = `splunk_python` request_path="/*/app/search/C:\\Program" *strings* | rex "request_path=(?<file_path>[^\"]+)" | rex field=file_path "[^\"]+/(?<file_name>[^\"\'\s/\\\\]+)" | stats min(_time) as firstTime max(_time) as lastTime values(file_path) as file_path values(file_name) as file_name by index, sourcetype, host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_windows_deserialization_file_partition_filter`

 [ESCU - Splunk ES DoS Investigations Manager via Investigation Creation - Rule]
 action.escu = 0
@@ -2464,6 +2500,42 @@ realtime_schedule = 0
 is_visible = false
 search = | rest /services/apps/local | search disabled=0 core=0 label="Splunk Add-on Builder" | dedup label | search version < 4.1.4 | eval WarningMessage="Splunk Add-on Builder Versions older than v4.1.4 contain a critical vulnerability. Update to Splunk Add-on Builder v4.1.4 or higher immediately. For more information about this vulnerability, please refer to https://advisory.splunk.com/advisories/SVD-2024-0111" | table label version WarningMessage | `splunk_information_disclosure_in_splunk_add_on_builder_filter`

+[ESCU - Splunk Information Disclosure on Account Login - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server.
+action.escu.how_to_implement = Requires access to internal indexes _internal.
+action.escu.known_false_positives = This is a hunting search and requires operator to search for large number of login failures from several users indicating possible user enumeration attempts. May capture genuine login failures.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Information Disclosure on Account Login - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Information Disclosure on Account Login - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "2bae5d19-6d1b-4db0-82ab-0af5ac5f836c", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkd` component=UiAuth status=failure action=login TcpChannelThread | stats count min(_time) as firstTime max(_time) as lastTime by user status action clientip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_information_disclosure_on_account_login_filter`
+
 [ESCU - Splunk list all nonstandard admin accounts - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2788,6 +2860,89 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkda` method="POST" uri="*/services/indexing/preview*" | table host clientip status useragent user uri_path | `splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter`

+[ESCU - Splunk RCE PDFgen Render - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote
+action.escu.how_to_implement = Requires access to internal indexes.
+action.escu.known_false_positives = This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk RCE PDFgen Render - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Possible exploitation against $host$
+action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 80}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk RCE PDFgen Render - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.CM"], "type": "TTP"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "bc2b7437-0400-438b-9537-21ab5b7d2d53", "detection_version": "1"}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote
+action.notable.param.rule_title = Splunk RCE PDFgen Render
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = index=_internal sourcetype=splunk_pdfgen _raw IN ("*base64*", "*lambda*", "*system*") | stats count min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host, _raw | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_rce_pdfgen_render_filter`
+
+[ESCU - Splunk RCE via External Lookup Copybuckets - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup.
+action.escu.how_to_implement = Requires access to internal indexes
+action.escu.known_false_positives = An operator must identify elements indicatives of command execution requests by looking at regex data being extracted from the log. Not all the requests will be malicious.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk RCE via External Lookup Copybuckets - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk RCE via External Lookup Copybuckets - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "8598f9de-bba8-42a4-8ef0-12e1adda4131", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = index=_internal sourcetype="splunk_archiver-too_small" *.csv | rex field=_raw "Invoking command:\s(?<command>.*)" | stats min(_time) as firstTime max(_time) as lastTime values(command) as command values(severity) as severity by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_rce_via_external_lookup_copybuckets_filter`
+
 [ESCU - Splunk RCE via Serialized Session Payload - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2977,8 +3132,8 @@ action.escu.data_models = ["Splunk_Audit"]
 action.escu.eli5 = The following analytic identifies the execution of high-risk commands associated with various Splunk vulnerability disclosures. It leverages the Splunk_Audit.Search_Activity datamodel to detect ad-hoc searches by non-system users that match known risky commands. This activity is significant for a SOC as it may indicate attempts to exploit known vulnerabilities within Splunk, potentially leading to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a severe threat to the organization's security posture.
 action.escu.how_to_implement = Requires implementation of Splunk_Audit.Search_Activity datamodel.
 action.escu.known_false_positives = This search encompasses many commands.
-action.escu.creation_date = 2024-05-05
-action.escu.modification_date = 2024-05-05
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule
 action.escu.search_type = detection
@@ -2990,8 +3145,8 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2023-22931", "CVE-2023-22934", "CVE-2023-22935", "CVE-2023-22936", "CVE-2023-22939", "CVE-2023-22940", "CVE-2023-40598", "CVE-2023-40598", "CVE-2023-46214", "CVE-2024-23676"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548", "T1202"], "nist": ["DE.AE"], "type": "Hunting"}
-action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "ee69374a-d27e-4136-adac-956a96ff60fd", "detection_version": "3"}
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2023-22931", "CVE-2023-22934", "CVE-2023-22935", "CVE-2023-22936", "CVE-2023-22939", "CVE-2023-22940", "CVE-2023-40598", "CVE-2023-40598", "CVE-2023-46214", "CVE-2024-23676", "CVE-2024-36984"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548", "T1202"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "ee69374a-d27e-4136-adac-956a96ff60fd", "detection_version": "4"}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -3004,30 +3159,30 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats fillnull_value="N/A" count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command as search output splunk_risky_command description vulnerable_versions CVE other_metadata | where splunk_risky_command != "false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_risky_command_abuse_disclosed_february_2023_filter`

-[ESCU - Splunk Stored XSS via Data Model objectName field - Rule]
+[ESCU - Splunk Stored XSS conf-web Settings on Premises - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = The following analytic identifies attempts to exploit a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise via the Data Model object name field. It detects this activity by analyzing web access logs (`splunkd_webx`) for specific URI patterns and non-null query parameters. This activity is significant because it allows authenticated users to inject and store malicious scripts, leading to persistent XSS attacks. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of other users, potentially leading to data theft, session hijacking, or further compromise of the Splunk environment.
+description = This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user.
 action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
 action.escu.data_models = []
-action.escu.eli5 = The following analytic identifies attempts to exploit a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise via the Data Model object name field. It detects this activity by analyzing web access logs (`splunkd_webx`) for specific URI patterns and non-null query parameters. This activity is significant because it allows authenticated users to inject and store malicious scripts, leading to persistent XSS attacks. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of other users, potentially leading to data theft, session hijacking, or further compromise of the Splunk environment.
-action.escu.how_to_implement = This vulnerability only affects Splunk Web enabled instances. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
-action.escu.known_false_positives = This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point.
-action.escu.creation_date = 2024-05-17
-action.escu.modification_date = 2024-05-17
+action.escu.eli5 = This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user.
+action.escu.how_to_implement = Requires access to internal indexes.
+action.escu.known_false_positives = This is a hunting search and will produce false positives, operator must identify XSS elemetns in the splunk_python log related to the vulnerable endpoint.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
 action.escu.confidence = high
-action.escu.full_search_name = ESCU - Splunk Stored XSS via Data Model objectName field - Rule
+action.escu.full_search_name = ESCU - Splunk Stored XSS conf-web Settings on Premises - Rule
 action.escu.search_type = detection
-action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = ["Splunk Internal Logs"]
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Splunk Stored XSS via Data Model objectName field - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2022-43569"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
-action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "062bff76-5f9c-496e-a386-cb1adcf69871", "detection_version": "2"}
+action.correlationsearch.label = ESCU - Splunk Stored XSS conf-web Settings on Premises - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 20, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "ed1209ef-228d-4dab-9856-be9369925a5c", "detection_version": "1"}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -3038,7 +3193,115 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `splunkd_webx` uri=/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model* uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`
+search = `splunk_python` *script* *eval* | stats min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_stored_xss_conf_web_settings_on_premises_filter`
+
+[ESCU - Splunk Stored XSS via Data Model objectName Field - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies attempts to exploit a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise via the Data Model object name field. It detects this activity by analyzing web access logs (`splunkd_webx`) for specific URI patterns and non-null query parameters. This activity is significant because it allows authenticated users to inject and store malicious scripts, leading to persistent XSS attacks. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of other users, potentially leading to data theft, session hijacking, or further compromise of the Splunk environment.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies attempts to exploit a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise via the Data Model object name field. It detects this activity by analyzing web access logs (`splunkd_webx`) for specific URI patterns and non-null query parameters. This activity is significant because it allows authenticated users to inject and store malicious scripts, leading to persistent XSS attacks. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of other users, potentially leading to data theft, session hijacking, or further compromise of the Splunk environment.
+action.escu.how_to_implement = This vulnerability only affects Splunk Web enabled instances. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+action.escu.known_false_positives = This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Stored XSS via Data Model objectName Field - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Splunk Internal Logs"]
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Stored XSS via Data Model objectName Field - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2022-43569"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "062bff76-5f9c-496e-a386-cb1adcf69871", "detection_version": "3"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkd_webx` uri=/*/splunkd/__raw/servicesNS/*/launcher/datamodel/model* uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`
+
+[ESCU - Splunk Stored XSS via Specially Crafted Bulletin Message - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following hunting detection provides fields related to /service/messages endpoints where specially crafted bulletin message can exploit stored XSS.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following hunting detection provides fields related to /service/messages endpoints where specially crafted bulletin message can exploit stored XSS.
+action.escu.how_to_implement = Need access to Splunk REST api data via search.
+action.escu.known_false_positives = Must look at messages field and find malicious suspicious characters or hyperlinks. Not all requests to this endpoint will be malicious.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Stored XSS via Specially Crafted Bulletin Message - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Stored XSS via Specially Crafted Bulletin Message - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 10, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "fd852b27-1882-4505-9f2c-64dfb96f4fc1", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | rest /services/messages | search message="*http*" | table id author message title | `splunk_stored_xss_via_specially_crafted_bulletin_message_filter`
+
+[ESCU - Splunk Unauthenticated DoS via Null Pointer References - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following hunting search provides information on splunkd crash as a result of a Denial of Service Exploitation via null pointer references which targets 'services/cluster/config' endpoint.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following hunting search provides information on splunkd crash as a result of a Denial of Service Exploitation via null pointer references which targets 'services/cluster/config' endpoint.
+action.escu.how_to_implement = Requires access to internal indexes.
+action.escu.known_false_positives = This is a hunting search and will produce false positives. An operator needs to find proximity and detail of requests targeting cluster config endpoint and subsequent Segmentation fault in splunk crash log.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Unauthenticated DoS via Null Pointer References - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Unauthenticated DoS via Null Pointer References - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1499"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "d67594fe-c317-41b8-9319-ec8428d5c2ea", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunk_crash_log` "Segmentation fault" "POST /services/cluster/config" | stats count min(_time) as firstTime max(_time) as  lastTime by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthenticated_dos_via_null_pointer_references_filter`

 [ESCU - Splunk Unauthenticated Log Injection Web Service Log - Rule]
 action.escu = 0
@@ -3076,6 +3339,114 @@ realtime_schedule = 0
 is_visible = false
 search = `splunkd_webx`  uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`

+[ESCU - Splunk Unauthenticated Path Traversal Modules Messaging - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This hunting search provides information on exploitation attempts against /modules/messaging endpoint, the exploit can be clearly seen as the ../ which signals an attempt to traverse target directories.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = This hunting search provides information on exploitation attempts against /modules/messaging endpoint, the exploit can be clearly seen as the ../ which signals an attempt to traverse target directories.
+action.escu.how_to_implement = Only applies to Microsoft Windows installations of Splunk.
+action.escu.known_false_positives = May catch other exploitation attempts using path traversal related characters.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Unauthenticated Path Traversal Modules Messaging - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = ["Splunk Internal Logs"]
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Unauthenticated Path Traversal Modules Messaging - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 20, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "e7c2b064-524e-4d65-8002-efce808567aa", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkd_web` method=GET uri_path="/*/modules/messaging/*..*" | stats min(_time) as firstTime max(_time) as lastTime values(method) as method values(uri_path) as uri_path by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthenticated_path_traversal_modules_messaging_filter`
+
+[ESCU - Splunk Unauthorized Experimental Items Creation - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This hunting search provides information on finding possible creation of unauthorized items against /experimental endpoint.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = This hunting search provides information on finding possible creation of unauthorized items against /experimental endpoint.
+action.escu.how_to_implement = Requires access to internal indexes.
+action.escu.known_false_positives = Not all requests are going to be malicious, there will be false positives, however operator must find suspicious items that might have been created by an unauthorized user.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Unauthorized Experimental Items Creation - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk Unauthorized Experimental Items Creation - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 5, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "84afda04-0cd6-466b-869e-70d6407d0a34", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkda` */experimental/* method=POST | stats count min(_time) as firstTime max(_time) as lastTime by clientip method uri_path uri status | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthorized_experimental_items_creation_filter`
+
+[ESCU - Splunk Unauthorized Notification Input by User - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = **WARNING**, this detection is marked **EXPERIMENTAL** by the Splunk Threat Research Team. This means that the detection has been manually tested but we do not have the associated attack data to perform automated testing or cannot share this attack dataset due to its sensitive nature. If you have any questions feel free to email us at: research@splunk.com. This hunting search provides information to track possible exploitation of a lower privilege user able to push notifications that may include malicious code as notifications for all users in Splunk. 
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = This hunting search provides information to track possible exploitation of a lower privilege user able to push notifications that may include malicious code as notifications for all users in Splunk.
+action.escu.how_to_implement = Requires access to Splunk rest data.
+action.escu.known_false_positives = This search will produce false positives which may include benign notifications from other Splunk entities, attention to suspicious or anomalous elements in notifications helps identify actual exploitation of this vulnerability.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk Unauthorized Notification Input by User - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Experimental - Splunk Unauthorized Notification Input by User - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 20, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "4b7f368f-4322-47f8-8363-2c466f0b7030", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | rest /services/messages | table title message severity timeCreated_iso published splunk_server author | `splunk_unauthorized_notification_input_by_user_filter`
+
 [ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -3179,8 +3550,8 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies potential exploitation of a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise 9.1.2. It detects suspicious requests to the Splunk web GUI that may execute JavaScript within script tags. This detection leverages logs from the `splunkd_ui` data source, focusing on specific URI paths and HTTP methods. This activity is significant as it can allow attackers to execute arbitrary JavaScript, potentially accessing the API with the logged-in user's permissions. If the user is an admin, the attacker could create an admin account, leading to full control over the Splunk environment.
 action.escu.how_to_implement = This search only applies to web-GUI-enabled Splunk instances and operator must have access to internal indexes.
 action.escu.known_false_positives = This is a hunting search and will produce false positives as it is not possible to view contents of a request payload. It shows the artifact resulting from a potential exploitation payload (the creation of a user with admin privileges).
-action.escu.creation_date = 2024-05-28
-action.escu.modification_date = 2024-05-28
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk XSS in Highlighted JSON Events - Rule
 action.escu.search_type = detection
@@ -3193,7 +3564,7 @@ dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Splunk XSS in Highlighted JSON Events - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
-action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "1030bc63-0b37-4ac9-9ae0-9361c955a3cc", "detection_version": "2"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "1030bc63-0b37-4ac9-9ae0-9361c955a3cc", "detection_version": "3"}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -3204,7 +3575,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `splunkd_ui` "/en-US/splunkd/__raw/servicesNS/nobody/search/authentication/users" status=201 | stats count min(_time) as firstTime max(_time) as lastTime by clientip, uri_path, method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_xss_in_highlighted_json_events_filter`
+search = `splunkd_ui` "/*/splunkd/__raw/servicesNS/nobody/search/authentication/users" status=201 | stats count min(_time) as firstTime max(_time) as lastTime by clientip, uri_path, method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_xss_in_highlighted_json_events_filter`

 [ESCU - Splunk XSS in Monitoring Console - Rule]
 action.escu = 0
@@ -3262,8 +3633,8 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies persistent cross-site scripting (XSS) attempts in the 'Save Table' dialog on the Splunk search page. It detects POST requests to the endpoint `/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model` containing potential XSS payloads. This activity is significant because it can allow a remote user with the "power" role to inject malicious scripts, leading to persistent XSS vulnerabilities. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of the affected user, potentially leading to data theft, session hijacking, or further exploitation within the Splunk environment.
 action.escu.how_to_implement = Watch for POST requests combined with XSS script strings or obfuscation against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model.
 action.escu.known_false_positives = If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances.
-action.escu.creation_date = 2024-05-27
-action.escu.modification_date = 2024-05-27
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk XSS in Save table dialog header in search page - Rule
 action.escu.search_type = detection
@@ -3276,7 +3647,7 @@ dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Splunk XSS in Save table dialog header in search page - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2022-43561"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
-action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "a974d1ee-ddca-4837-b6ad-d55a8a239c20", "detection_version": "2"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "a974d1ee-ddca-4837-b6ad-d55a8a239c20", "detection_version": "3"}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -3287,7 +3658,79 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `splunkd_webx` method=POST  uri=/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`
+search = `splunkd_webx` method=POST  uri=/*/splunkd/__raw/servicesNS/nobody/search/datamodel/model | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`
+
+[ESCU - Splunk XSS Privilege Escalation via Custom Urls in Dashboard - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges.
+action.escu.how_to_implement = Requires access to internal indexes _audit and _internal.
+action.escu.known_false_positives = This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk XSS Privilege Escalation via Custom Urls in Dashboard - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = ["Splunk Internal Logs"]
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk XSS Privilege Escalation via Custom Urls in Dashboard - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 10, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "01e1e386-7656-4f36-a55a-52fe39b04a96", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkd_ui` method=POST /*/data/ui/views* | stats values(method) as method by _time index, sourcetype, host | eval event="post_request" | append [| search `audittrail` action="edit_user" operation="create" | rex field=_raw "object=\"(?<newUser>.*)\"" | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser | eval event="create_user"] | sort - _time | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`
+
+[ESCU - Splunk XSS Via External Urls in Dashboards SSRF - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This is a hunting search that provides elements to find possible dashboards created with external URL references in order to elicit Server Side Request Forgery from /data/ui/views endpoint.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = This is a hunting search that provides elements to find possible dashboards created with external URL references in order to elicit Server Side Request Forgery from /data/ui/views endpoint.
+action.escu.how_to_implement = Requires access to internal indexes.
+action.escu.known_false_positives = This is a hunting search and requires an operator to search for specific indicators of Server Side Request Forgery attack against /data/ui/views. It is not possible to grab display the payloads of such requests, so this search provides users, ip addresses, requests, files, and queries that may indicate malicious intent. There will be false positives.
+action.escu.creation_date = 2024-07-01
+action.escu.modification_date = 2024-07-01
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Splunk XSS Via External Urls in Dashboards SSRF - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise"]
+action.escu.providing_technologies = ["Splunk Internal Logs"]
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Splunk XSS Via External Urls in Dashboards SSRF - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 10, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "type": "Hunting"}
+action.correlationsearch.metadata = {"deprecated": "0", "detection_id": "b0a67520-ae82-4cf6-b04e-9f6cce56830d", "detection_version": "1"}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `splunkd_web` user=* uri_path="/*/manager/permissions/launcher/data/ui/views/*" file=* | stats count min(_time) as firstTime max(_time) as lastTime by clientip user file host method uri_path uri_query | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_xss_via_external_urls_in_dashboards_ssrf_filter`

 [ESCU - Splunk XSS via View - Rule]
 action.escu = 0
@@ -9068,8 +9511,8 @@ action.escu.data_models = ["Change"]
 action.escu.eli5 = The following analytic identifies the creation of cloud compute instances by users who have not previously created them. It leverages data from the Change data model, focusing on 'create' actions by users, and cross-references with a baseline of known user activities. This activity is significant as it may indicate unauthorized access or misuse of cloud resources by new or compromised accounts. If confirmed malicious, attackers could deploy unauthorized compute instances, leading to potential data exfiltration, increased costs, or further exploitation within the cloud environment.
 action.escu.how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
 action.escu.known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
-action.escu.creation_date = 2025-05-18
-action.escu.modification_date = 2025-05-18
+action.escu.creation_date = 2024-05-18
+action.escu.modification_date = 2024-05-18
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule
 action.escu.search_type = detection
@@ -22277,8 +22720,8 @@ action.escu.data_models = ["Change"]
 action.escu.eli5 = The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network.
 action.escu.how_to_implement = ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.
 action.escu.known_false_positives = It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.
-action.escu.creation_date = 2025-05-20
-action.escu.modification_date = 2025-05-20
+action.escu.creation_date = 2024-05-20
+action.escu.modification_date = 2024-05-20
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Excessive User Account Lockouts - Rule
 action.escu.search_type = detection
@@ -49192,8 +49635,8 @@ action.escu.data_models = ["Change"]
 action.escu.eli5 = The following analytic detects the creation of a new local user account on a Windows system. It leverages Windows Security Audit logs, specifically event ID 4720, to identify this activity. Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.
 action.escu.how_to_implement = This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/
 action.escu.known_false_positives = It is possible that an administrator created the account. Verifying activity with an administrator is advised. This analytic is set to anomaly to allow for risk to be added. Filter and tune as needed. Restrict to critical infrastructure to reduce any volume.
-action.escu.creation_date = 2025-05-19
-action.escu.modification_date = 2025-05-19
+action.escu.creation_date = 2024-05-19
+action.escu.modification_date = 2024-05-19
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Create Local Account - Rule
 action.escu.search_type = detection
@@ -1,7 +1,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -451,7 +451,7 @@ match_type = WILDCARD(service)
 min_matches = 1

 [splunk_risky_command]
-filename = splunk_risky_command_20240122.csv
+filename = splunk_risky_command_20240601.csv
 default_match = false
 case_sensitive_match = false
 # description = A list of Risky Splunk Command that are candidates for abuse
@@ -1,7 +1,7 @@
 #############
 # Automatically generated by 'contentctl build' from 
 # https://github.com/splunk/contentctl
-# On Date: 2024-06-26T20:16:58 UTC
+# On Date: 2024-07-01T17:41:43 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -13,3 +13,4 @@
 runshellscript may be abused to exploit legacy internal functions in external lookups leading to arbitrary code execution","<8.1.14, <8.2.12, <9.0.6, <9.1.1;
 <8.2.12, <9.0.6, <9.1.1","CVE-2023-40598, CVE-2023-46214",
 "*|*mrollup*","The “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.","<9.0.8, <9.1.3, <9.1.2308.200","CVE-2024-23676",
+"*|*mstats*", "The "mstats" SPL command lets malicious user can control a search query in Analytics Workspace using params from another search (via job SID) and quotation mark ' ' and " incorrect handling", "<9.0.10, <9.1.5, <9.2.2","CVE-2024-36984"
@@ -1 +1 @@
-{"version": {"name": "v4.34.0", "published_at": "2024-06-26T20:17:00Z"}}
+{"version": {"name": "v4.35.0", "published_at": "2024-07-01T17:41:45Z"}}
@@ -1,5 +1,5 @@
 description: A list of Risky Splunk Command that are candidates for abuse
-filename: splunk_risky_command_20240122.csv
+filename: splunk_risky_command_20240601.csv
 name: splunk_risky_command
 default_match: 'false'
 match_type: WILDCARD(splunk_risky_command)
@@ -13,3 +13,4 @@
 runshellscript may be abused to exploit legacy internal functions in external lookups leading to arbitrary code execution","<8.1.14, <8.2.12, <9.0.6, <9.1.1;
 <8.2.12, <9.0.6, <9.1.1","CVE-2023-40598, CVE-2023-46214",
 "*|*mrollup*","The “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.","<9.0.8, <9.1.3, <9.1.2308.200","CVE-2024-23676",
+"*|*mstats*", "The "mstats" SPL command lets malicious user can control a search query in Analytics Workspace using params from another search (via job SID) and quotation mark ' ' and " incorrect handling", "<9.0.10, <9.1.5, <9.2.2","CVE-2024-36984"
@@ -0,0 +1,4 @@
+definition: index=_internal sourcetype=splunk_web_service
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: splunkd_webs