mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Jose Enrique Hernandez
54 lines
2.4 KiB
YAML
54 lines
2.4 KiB
YAML
name: Splunk protocol impersonation weak encryption simplerequest
|
|
id: 839d12a6-b119-4d44-ac4f-13eed95412c8
|
|
version: 1
|
|
date: '2022-05-24'
|
|
author: Rod Soto, Splunk
|
|
type: Hunting
|
|
datamodel: []
|
|
search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`'
|
|
description: On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request.
|
|
how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
|
|
known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
|
|
references:
|
|
- https://www.splunk.com/en_us/product-security
|
|
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
|
|
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: Endpoint
|
|
cve:
|
|
- CVE-2022-32152
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 80
|
|
context:
|
|
- Source:Endpoint
|
|
dataset:
|
|
- https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt
|
|
impact: 50
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: Failed to validate certificate on $host$
|
|
mitre_attack_id:
|
|
- T1588.004
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: Hostname
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- host
|
|
- event_message
|
|
- path
|
|
risk_score: 40
|
|
security_domain: threat
|