mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
69 lines
3.0 KiB
YAML
69 lines
3.0 KiB
YAML
name: Splunk protocol impersonation weak encryption simplerequest
|
|
id: 839d12a6-b119-4d44-ac4f-13eed95412c8
|
|
version: 2
|
|
date: '2024-05-23'
|
|
author: Rod Soto, Splunk
|
|
status: production
|
|
type: Hunting
|
|
description: The following analytic identifies instances where Splunk's Python3 client
|
|
libraries fail to validate SSL certificates properly. It leverages logs from `splunk_python`
|
|
to detect when "simpleRequest SSL certificate validation is enabled without hostname
|
|
verification." This activity is significant because improper SSL certificate validation
|
|
can expose the system to man-in-the-middle attacks, allowing attackers to intercept
|
|
or alter data. If confirmed malicious, this vulnerability could lead to unauthorized
|
|
access, data breaches, and potential system compromise. Upgrading to Splunk version
|
|
9 and configuring TLS hostname validation is recommended to mitigate this risk.
|
|
data_source:
|
|
- Splunk
|
|
search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without
|
|
hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`'
|
|
how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation
|
|
for Splunk Python modules in order to apply this search. Splunk SOAR customers can
|
|
find a SOAR workbook that walks an analyst through the process of running these
|
|
hunting searches in the references list of this detection. In order to use this
|
|
workbook, a user will need to run a curl command to post the file to their SOAR
|
|
instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template
|
|
-d @splunk_psa_0622.json". A user should then create an empty container or case,
|
|
attach the workbook, and begin working through the tasks.
|
|
known_false_positives: This search tries to address validation of server and client
|
|
certificates within Splunk infrastructure, it might produce results from accidental
|
|
or unintended requests to port 8089.
|
|
references:
|
|
- https://www.splunk.com/en_us/product-security
|
|
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
|
|
- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: Endpoint
|
|
confidence: 80
|
|
cve:
|
|
- CVE-2022-32152
|
|
impact: 50
|
|
message: Failed to validate certificate on $host$
|
|
mitre_attack_id:
|
|
- T1588.004
|
|
observable:
|
|
- name: host
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- host
|
|
- event_message
|
|
- path
|
|
risk_score: 40
|
|
security_domain: threat
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt
|
|
source: /opt/splunk/var/log/splunk/splunkd.log
|
|
sourcetype: splunk_python
|
|
custom_index: _internal
|