mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
61 lines
1.7 KiB
YAML
61 lines
1.7 KiB
YAML
name: Suspicious Java Classes
|
|
id: 6ed33786-5e87-4f55-b62c-cb5f1168b831
|
|
version: 1
|
|
date: '2018-12-06'
|
|
author: Jose Hernandez, Splunk
|
|
type: Anomaly
|
|
datamodel: []
|
|
description: This search looks for suspicious Java classes that are often used to
|
|
exploit remote command execution in common Java frameworks, such as Apache Struts.
|
|
search: '`stream_http` http_method=POST http_content_length>1 | regex form_data="(?i)java\.lang\.(?:runtime|processbuilder)"
|
|
| rename src_ip as src | stats count earliest(_time) as firstTime, latest(_time)
|
|
as lastTime, values(url) as uri, values(status) as status, values(http_user_agent)
|
|
as http_user_agent by src, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
| `suspicious_java_classes_filter`'
|
|
how_to_implement: In order to properly run this search, Splunk needs to ingest data
|
|
from your web-traffic appliances that serve or sit in the path of your Struts application
|
|
servers. This can be accomplished by indexing data from a web proxy, or by using
|
|
network traffic-analysis tools, such as Splunk Stream or Bro.
|
|
known_false_positives: There are no known false positives.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Apache Struts Vulnerability
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 7
|
|
- CIS 12
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
nist:
|
|
- DE.AE
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- http_method
|
|
- http_content_length
|
|
- src_ip
|
|
- url
|
|
- status
|
|
- http_user_agent
|
|
- src
|
|
- dest
|
|
security_domain: threat
|
|
confidence: 50
|
|
impact: 50
|
|
risk_score: 25
|
|
context: []
|
|
message: tbd
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|