mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
58 lines
2.0 KiB
YAML
58 lines
2.0 KiB
YAML
name: Splunk DOS Via Dump SPL Command
|
|
id: fb0e6823-365f-48ed-b09e-272ac4c1dad6
|
|
version: 2
|
|
date: '2024-05-03'
|
|
author: Rod Soto
|
|
status: production
|
|
type: Hunting
|
|
data_source:
|
|
- Splunk
|
|
description: The following analytic identifies a potential Denial of Service (DoS)
|
|
attack exploiting the dump SPL command in vulnerable Splunk Enterprise versions.
|
|
It detects this activity by searching the `splunk_crash_log` for segmentation fault
|
|
entries, indicating a crash of the Splunk daemon. This activity is significant for
|
|
a SOC because it can disrupt the availability of Splunk services, impacting monitoring
|
|
and incident response capabilities. If confirmed malicious, this attack could render
|
|
Splunk Enterprise unusable, severely hindering an organization's ability to detect
|
|
and respond to other security threats.
|
|
search: '`splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`'
|
|
how_to_implement: This search does not require additional ingestion of data. Requires
|
|
the ability to search _internal index and monitor segmentation faults.
|
|
known_false_positives: Segmentation faults may occur due to other causes, so this
|
|
search may produce false positives
|
|
references:
|
|
- https://advisory.splunk.com/
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: Endpoint
|
|
atomic_guid: []
|
|
confidence: 100
|
|
impact: 100
|
|
message: Possible denial of service attack with Victim $host$
|
|
mitre_attack_id:
|
|
- T1499.004
|
|
observable:
|
|
- name: host
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
risk_score: 100
|
|
required_fields:
|
|
- host
|
|
- source
|
|
- event_message
|
|
- status
|
|
- _time
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_dos_via_dump_spl_command.log
|
|
source: /opt/splunk/var/log/splunk/splunkd.log
|
|
sourcetype: splunkd_crash_log
|
|
custom_index: _internal
|