mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
73 lines
2.8 KiB
YAML
73 lines
2.8 KiB
YAML
name: Splunk Absolute Path Traversal Using runshellscript
|
|
id: 356bd3fe-f59b-4f64-baa1-51495411b7ad
|
|
version: 2
|
|
date: '2024-05-17'
|
|
author: Rod Soto
|
|
status: production
|
|
type: Hunting
|
|
data_source:
|
|
- Splunk
|
|
description: The following analytic detects the exploitation of an absolute path traversal
|
|
vulnerability in Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1,
|
|
where an attacker can execute arbitrary code located on a separate disk. It leverages
|
|
logs from the `splunk_python` macro, specifically looking for the `runshellscript`
|
|
command with a specific argument count and path pattern. This activity is significant
|
|
as it indicates a potential exploitation attempt that could lead to unauthorized
|
|
code execution. If confirmed malicious, this could allow an attacker to gain control
|
|
over the Splunk instance, leading to data breaches or further system compromise.
|
|
search: >-
|
|
`splunk_python` *runshellscript* | eval log_split=split(_raw, "runshellscript:
|
|
")
|
|
| eval array_raw = mvindex(log_split,1)
|
|
| eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","")
|
|
| eval array_indices=split(data_cleaned,",")
|
|
| eval runshellscript_args_count=mvcount(array_indices)
|
|
| where runshellscript_args_count = 10
|
|
| eval interpreter=mvindex(array_indices,0)
|
|
| eval targetScript=mvindex(array_indices,1)
|
|
| eval targetScript != "*C:*"
|
|
| stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter
|
|
targetScript
|
|
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|
|
| `splunk_absolute_path_traversal_using_runshellscript_filter`
|
|
how_to_implement: Must have access to internal indexes. Only applies to Splunk on
|
|
Windows versions.
|
|
known_false_positives: The command runshellscript can be used for benign purposes.
|
|
Analyst will have to review the searches and determined maliciousness specially
|
|
by looking at targeted script.
|
|
references:
|
|
- https://advisory.splunk.com/advisories/SVD-2023-0806
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: Endpoint
|
|
confidence: 70
|
|
impact: 50
|
|
message: Possible attack against splunk_server $splunk_server$ through abuse of
|
|
the runshellscript command
|
|
mitre_attack_id:
|
|
- T1083
|
|
cve:
|
|
- CVE-2023-40597
|
|
observable:
|
|
- name: splunk_server
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
risk_score: 35
|
|
required_fields:
|
|
- search
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_absolute_path_traversal_using_runshellscript_splunk_python.log
|
|
source: python.log
|
|
sourcetype: splunk_python
|
|
custom_index: _internal
|