mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
63 lines
2.2 KiB
YAML
63 lines
2.2 KiB
YAML
name: Splunk DOS via printf search function
|
|
id: 78b48d08-075c-4eac-bd07-e364c3780867
|
|
version: 2
|
|
date: '2024-05-25'
|
|
author: Rod Soto, Eric McGinnis, Splunk
|
|
status: production
|
|
type: Hunting
|
|
data_source:
|
|
- Splunk
|
|
description: The following analytic identifies the use of the `printf` SPL function
|
|
in Splunk searches, which can be exploited for a denial of service (DoS) attack.
|
|
It detects this activity by querying the `audit_searches` data source for specific
|
|
patterns involving `makeresults`, `eval`, `fieldformat`, and `printf` functions,
|
|
excluding searches by the `splunk_system_user`. This activity is significant because
|
|
it targets a known vulnerability in Splunk Enterprise versions lower than 8.1.14,
|
|
8.2.12, 9.0.6, and 9.1.1, potentially disrupting the availability of the Splunk
|
|
instance. If confirmed malicious, this could lead to service outages and impact
|
|
the monitoring and logging capabilities of the organization.
|
|
search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user"
|
|
search!="*audit_searches*" | stats count by user splunk_server host search | convert
|
|
ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
|
|
how_to_implement: This search requires the ability to search internal indexes.
|
|
known_false_positives: This search may produces false positives, analyst most focuse
|
|
in the use of printf conversion function of eval to craft an expression that splunkd
|
|
cannot interpret correctly causing it to crash.
|
|
references:
|
|
- https://advisory.splunk.com/
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: Endpoint
|
|
confidence: 100
|
|
impact: 100
|
|
message: Possible denial of service attack against $host$
|
|
cve:
|
|
- CVE-2023-40594
|
|
mitre_attack_id:
|
|
- T1499.004
|
|
observable:
|
|
- name: host
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
risk_score: 100
|
|
required_fields:
|
|
- user
|
|
- splunk_server
|
|
- host
|
|
- search
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log
|
|
source: audittrail
|
|
sourcetype: audittrail
|
|
custom_index: _audit
|