mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Jose Enrique Hernandez
52 lines
2.8 KiB
YAML
52 lines
2.8 KiB
YAML
name: Splunk Digital Certificates Infrastructure Version
|
|
id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7
|
|
version: 1
|
|
date: '2022-05-26'
|
|
author: Lou Stella, Splunk
|
|
type: Hunting
|
|
datamodel: []
|
|
description: This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked.
|
|
search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`'
|
|
how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
|
|
known_false_positives: No known at this time.
|
|
references:
|
|
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication
|
|
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html
|
|
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
cve:
|
|
- CVE-2022-32153
|
|
confidence: 100
|
|
context:
|
|
- Source:Endpoint
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
|
|
impact: 50
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: $splunk_server$ may not be properly validating TLS Certificates
|
|
mitre_attack_id:
|
|
- T1587.003
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: splunk_server
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- none
|
|
risk_score: 50
|
|
security_domain: threat
|