merged with develop

Author: Patrick

.gitignore

@@ -127,3 +127,4 @@ bin/docker_detection_tester/test_results/
 lookups/APP_ENRICHMENT_CACHE.db.db
 lookups/CVE_CACHE.db.db
 lookups/REFERENCE_CACHE.db.db	
+*.code-workspace

bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py

@@ -78,6 +78,7 @@ def writeObjects(self, objects: list, output_path: str, type: SecurityContentTyp
                         "id": True,
                         "eventSchema": True,
                         "version": True,
+                        "status": True,
                         "description": True,
                         "search": True,
                         "how_to_implement": True,

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/attacker_tools_on_endpoint.yml

@@ -1,13 +1,22 @@
 name: Attacker Tools On Endpoint
 id: a51bfe1a-94f0-48cc-b4e4-16a110145893
-version: 2
-date: '2021-11-04'
+version: 3
+date: '2023-08-25'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search looks for execution of commonly used attacker tools on an
-  endpoint.
+description: This search looks for the execution of commonly used attacker tools on an
+  endpoint. These tools, listed in the attacker_tools.csv, include remcom.exe, an open-source
+  replacement for psexec, pwdump.exe and pwdump2.exe, which are used to dump password hashes
+  on a Windows system, and nc.exe, an open-source tool used for network communications. Other
+  tools like wce.exe, used for dumping hashes and executing pass-the-hash and pass-the-ticket
+  attacks, and cain.exe, used for collecting user credentials and executing attacks, are also
+  monitored. The search also tracks tools like nmap.exe, an open-source network mapping tool,
+  and kidlogger.exe, used for collecting keyboard input on a host. The list also includes
+  tools that are used by attackers to hide in plain sight and look like legitimate Windows
+  system processes, such as isass.exe and svch0st.exe. The search is designed to provide
+  comprehensive monitoring of potential threats and unauthorized software on an endpoint.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Processes.process) as process values(Processes.parent_process)
   as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown

detections/application/okta_mfa_exhaustion_hunt.yml

@@ -39,11 +39,11 @@ tags:
   asset_type: Infrastructure
   confidence: 60
   impact: 30
-  message: $src_user$ account has rejected multiple Okta pushes.
+  message: $user$ account has rejected multiple Okta pushes.
   mitre_attack_id:
   - T1110
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Attacker
@@ -53,7 +53,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - src_user
+  - user
   - src_ip
   - eventType
   - status

detections/application/okta_two_or_more_rejected_okta_pushes.yml

@@ -33,11 +33,11 @@ tags:
   asset_type: Infrastructure
   confidence: 80
   impact: 80
-  message: $src_user$ account has rejected multiple Okta pushes.
+  message: $user$ account has rejected multiple Okta pushes.
   mitre_attack_id:
   - T1110
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Attacker
@@ -47,7 +47,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - src_user
+  - user
   - src_ip
   - eventType
   - status

detections/application/splunk_dos_via_printf_search_function.yml

@@ -0,0 +1,50 @@
+name: Splunk DOS via printf search function
+id: 78b48d08-075c-4eac-bd07-e364c3780867
+version: 1
+date: '2023-08-30'
+author: Rod Soto, Eric McGinnis, Splunk
+status: production
+type: Hunting
+data_source: []
+description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
+search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search!="*audit_searches*" 
+  | stats count by user splunk_server host search 
+  | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
+how_to_implement: This search requires the ability to search internal indexes. 
+known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. 
+references:
+- https://advisory.splunk.com/
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: endpoint
+  confidence: 100
+  impact: 100
+  message: Possible denial of service attack against $host$
+  cve:
+  - CVE-2023-40594
+  mitre_attack_id:
+  - T1499.004
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 100
+  required_fields:
+  - user 
+  - splunk_server
+  - host
+  - search 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml

@@ -30,7 +30,7 @@ tags:
   mitre_attack_id:
     - T1189
   observable:
-    - name: User
+    - name: user
       type: User
       role:
         - Victim

detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml

@@ -36,7 +36,7 @@ tags:
   mitre_attack_id:
   - T1588.004
   observable:
-  - name: Hostname
+  - name: host
     type: Hostname
     role:
     - Victim

detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml

@@ -38,7 +38,7 @@ tags:
   mitre_attack_id:
   - T1588.004
   observable:
-  - name: Hostname
+  - name: host
     type: Hostname
     role:
     - Victim

detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml

@@ -1,17 +1,13 @@
 name: Splunk risky Command Abuse disclosed february 2023
 id: ee69374a-d27e-4136-adac-956a96ff60fd
 version: 2
-date: '2023-02-14'
+date: '2023-08-30'
 author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
 status: production
 type: Hunting
-description: In February 2023, Splunk disclosed several vulnerabilities affecting
-  Splunk Enterprise commands deemed risky. The following hunting search includes the
-  following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10),
-  pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below
-  8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more
-  information please review Splunk Vulnerabilities Disclosure, February 2023. Link
-  can be found in reference.
+description: This search looks for a variety of high-risk commands throughout
+  a number of different Splunk Vulnerability Disclosures.  Please refer to the
+  following URL for additional information on these disclosures - https://advisory.splunk.com
 data_source: []
 search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity
   where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
@@ -35,6 +31,7 @@ tags:
   - CVE-2023-22936
   - CVE-2023-22939
   - CVE-2023-22940
+  - CVE-2023-40598
   impact: 50
   message: Use of risky splunk command $splunk_risky_command$ detected by $user$
   mitre_attack_id:
@@ -67,3 +64,9 @@ tests:
     source: audittrail
     sourcetype: audittrail
     custom_index: _audit
+- name: True Positive Test runshellscript abuse
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit