mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
pyth0n1c
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
name: Splunk DOS Via Dump SPL Command
|
|
id: fb0e6823-365f-48ed-b09e-272ac4c1dad6
|
|
version: 1
|
|
date: '2023-05-10'
|
|
author: Rod Soto
|
|
status: production
|
|
type: Hunting
|
|
data_source:
|
|
- splunkd.log
|
|
description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
|
|
search: '`splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`'
|
|
how_to_implement: This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults.
|
|
known_false_positives: Segmentation faults may occur due to other causes, so this search may produce false positives
|
|
references:
|
|
- https://advisory.splunk.com/
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: endpoint
|
|
atomic_guid: []
|
|
confidence: 100
|
|
impact: 100
|
|
message: Possible denial of service attack with Victim $host$
|
|
mitre_attack_id:
|
|
- T1499.004
|
|
observable:
|
|
- name: host
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
risk_score: 100
|
|
required_fields:
|
|
- host
|
|
- source
|
|
- event_message
|
|
- status
|
|
- _time
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_dos_via_dump_spl_command.log
|
|
source: /opt/splunk/var/log/splunk/splunkd.log
|
|
sourcetype: splunkd_crash_log
|
|
custom_index: _internal |