splunk_command_and_scripting_interpreter_delete_usage.yml

name: Splunk Command and Scripting Interpreter Delete Usage
id: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04
version: 1
date: '2022-05-27'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of the risky command - Delete
  - that may be utilized in Splunk to delete some or all data queried for. In order
  to use Delete in Splunk, one must be assigned the role. This is typically not used
  and should generate an anomaly if it is used.
data_source: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search
  IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
  by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user
  Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`'
how_to_implement: To successfully implement this search acceleration is recommended
  against the Search_Activity datamodel that runs against the splunk _audit index.
  In addition, this analytic requires the Common Information Model App which includes
  the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/.
known_false_positives: False positives may be present if this command is used as a
  common practice. Filter as needed.
references:
- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
tags:
  analytic_story:
  - Splunk Vulnerabilities
  asset_type: Web Server
  confidence: 30
  cve:
  - CVE-2022-32154
  impact: 90
  message: $user$ executed the 'delete' command, if this is unexpected it should be
    reviewed.
  mitre_attack_id:
  - T1059
  observable:
  - name: user
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Search_Activity.search
  - Search_Activity.info
  - Search_Activity.total_run_time
  - Search_Activity.user
  - Search_Activity.savedsearch_name
  - Search_Activity.search_type
  risk_score: 27
  security_domain: audit
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
    source: audittrail
    sourcetype: audittrail
    update_timestamp: true
    custom_index: _audit