name: Splunk protocol impersonation weak encryption simplerequest
id: 839d12a6-b119-4d44-ac4f-13eed95412c8
version: 1
date: '2022-05-24'
author: Rod Soto, Splunk
type: Hunting
datamodel: []
search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`'
description: On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request.
how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
references:
- https://www.splunk.com/en_us/product-security
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
  analytic_story:
  - Splunk Vulnerabilities
  asset_type: Endpoint
  cve:
  - CVE-2022-32152
  cis20:
  - CIS 3
  - CIS 5
  - CIS 16
  confidence: 80
  context:
  - Source:Endpoint
  dataset:
  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt
  impact: 50
  kill_chain_phases:
  - Exploitation
  message: Failed to validate certificate on $host$
  mitre_attack_id:
  -  T1588.004
  nist:
  - DE.CM
  observable:
  - name: Hostname
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - host
  - event_message
  - path
  risk_score: 40
  security_domain: threat