name: Splunk DOS via printf search function
id: 78b48d08-075c-4eac-bd07-e364c3780867
version: 2
date: '2024-05-25'
author: Rod Soto, Eric McGinnis, Splunk
status: production
type: Hunting
data_source:
- Splunk
description: The following analytic identifies the use of the `printf` SPL function
  in Splunk searches, which can be exploited for a denial of service (DoS) attack.
  It detects this activity by querying the `audit_searches` data source for specific
  patterns involving `makeresults`, `eval`, `fieldformat`, and `printf` functions,
  excluding searches by the `splunk_system_user`. This activity is significant because
  it targets a known vulnerability in Splunk Enterprise versions lower than 8.1.14,
  8.2.12, 9.0.6, and 9.1.1, potentially disrupting the availability of the Splunk
  instance. If confirmed malicious, this could lead to service outages and impact
  the monitoring and logging capabilities of the organization.
search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user"
  search!="*audit_searches*" | stats count by user splunk_server host search | convert
  ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
how_to_implement: This search requires the ability to search internal indexes.
known_false_positives: This search may produces false positives, analyst most focuse
  in the use of printf conversion function of eval to craft an expression that splunkd
  cannot interpret correctly causing it to crash.
references:
- https://advisory.splunk.com/
tags:
  analytic_story:
  - Splunk Vulnerabilities
  asset_type: Endpoint
  confidence: 100
  impact: 100
  message: Possible denial of service attack against $host$
  cve:
  - CVE-2023-40594
  mitre_attack_id:
  - T1499.004
  observable:
  - name: host
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 100
  required_fields:
  - user
  - splunk_server
  - host
  - search
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log
    source: audittrail
    sourcetype: audittrail
    custom_index: _audit