splunk-security_content/docs/_stories/splunk_vulnerabilities.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Splunk Vulnerabilities	2022-03-28	true		Splunk Enterprise Splunk Enterprise Security Splunk Cloud Splunk_Audit Actions on Objectives Delivery Exploitation Reconnaissance

Try in Splunk Security Cloud{: .btn .btn--success}

Description

Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Splunk_Audit
• Last Updated: 2022-03-28
• Author: Lou Stella, Splunk
• ID: 5354df00-dce2-48ac-9a64-8adb48006828

Narrative

This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.

Detections

Name	Technique	Type
Detect Risky SPL using Pretrained ML Model	Command and Scripting Interpreter	Anomaly
Path traversal SPL injection	File and Directory Discovery	TTP
Splunk Command and Scripting Interpreter Delete Usage	Command and Scripting Interpreter	Anomaly
Splunk Command and Scripting Interpreter Risky Commands	Command and Scripting Interpreter	Hunting
Splunk Command and Scripting Interpreter Risky SPL MLTK	Command and Scripting Interpreter	Anomaly
Splunk Digital Certificates Infrastructure Version	Digital Certificates	Hunting
Splunk Digital Certificates Lack of Encryption	Digital Certificates	Anomaly
Splunk DoS via Malformed S2S Request	Network Denial of Service	TTP
Splunk Process Injection Forwarder Bundle Downloads	Process Injection	Hunting
Splunk Protocol Impersonation Weak Encryption Configuration	Protocol Impersonation	Hunting
Splunk protocol impersonation weak encryption selfsigned	Digital Certificates	Hunting
Splunk protocol impersonation weak encryption simplerequest	Digital Certificates	Hunting
Splunk User Enumeration Attempt	Valid Accounts	TTP
Splunk XSS in Monitoring Console	Drive-by Compromise	TTP
Open Redirect in Splunk Web	None	TTP
Splunk Enterprise Information Disclosure	None	TTP
Splunk Identified SSL TLS Certificates	Network Sniffing	Hunting

Reference

• https://www.splunk.com/en_us/product-security/announcements.html

source | version: 1