mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
59 lines
2.3 KiB
YAML
59 lines
2.3 KiB
YAML
name: Splunk Absolute Path Traversal Using runshellscript
|
|
id: 356bd3fe-f59b-4f64-baa1-51495411b7ad
|
|
version: 1
|
|
date: '2023-09-05'
|
|
author: Rod Soto
|
|
status: production
|
|
type: Hunting
|
|
data_source: []
|
|
description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
|
|
search: >-
|
|
`splunk_python` *runshellscript*
|
|
| eval log_split=split(_raw, "runshellscript: ")
|
|
| eval array_raw = mvindex(log_split,1)
|
|
| eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","")
|
|
| eval array_indices=split(data_cleaned,",")
|
|
| eval runshellscript_args_count=mvcount(array_indices)
|
|
| where runshellscript_args_count = 10
|
|
| eval interpreter=mvindex(array_indices,0)
|
|
| eval targetScript=mvindex(array_indices,1)
|
|
| eval targetScript != "*C:*"
|
|
| stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter targetScript
|
|
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|
|
| `splunk_absolute_path_traversal_using_runshellscript_filter`
|
|
how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions.
|
|
known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script.
|
|
references:
|
|
- https://advisory.splunk.com/advisories/SVD-2023-0806
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: endpoint
|
|
confidence: 70
|
|
impact: 50
|
|
message: Possible attack against splunk_server $splunk_server$ through abuse of the runshellscript command
|
|
mitre_attack_id:
|
|
- T1083
|
|
cve:
|
|
- CVE-2023-40597
|
|
observable:
|
|
- name: splunk_server
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
risk_score: 35
|
|
required_fields:
|
|
- search
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_absolute_path_traversal_using_runshellscript_splunk_python.log
|
|
source: python.log
|
|
sourcetype: splunk_python
|
|
custom_index: _internal
|