splunk_dos_via_dump_spl_command.yml

name: Splunk DOS Via Dump SPL Command
id: fb0e6823-365f-48ed-b09e-272ac4c1dad6
version: 1
date: '2023-05-10'
author: Rod Soto
status: production
type: Hunting
data_source:
- splunkd.log
description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can exploit a vulnerability in the dump SPL command to cause a Denial of Service by crashing the Splunk daemon.
search: '`splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`'
how_to_implement: This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults.
known_false_positives: Segmentation faults may occur due to other causes, so this search may produce false positives 
references:
- https://advisory.splunk.com/
tags:
  analytic_story:
  - Splunk Vulnerabilities
  asset_type: endpoint
  atomic_guid: []
  confidence: 100
  impact: 100
  message: Possible denial of service attack with Victim $host$
  mitre_attack_id:
  - T1499.004
  observable:
  - name: host
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  risk_score: 100
  required_fields:
  - host 
  - source 
  - event_message
  - status
  - _time
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_dos_via_dump_spl_command.log
    source: /opt/splunk/var/log/splunk/splunkd.log
    sourcetype: splunkd_crash_log
    custom_index: _internal