2230214 release

detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml

@@ -0,0 +1,54 @@
+name: Splunk csrf in the ssg kvstore client endpoint
+id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410
+version: 1
+date: "2023-02-14"
+author: Rod Soto
+type: TTP
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the kvstore_client endpoint allows for updating SSG KV store collections via a GET request. SSG is a Splunk Built app included by default with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled. This hunting search provides information on affected server specific method and post data that may reveal exploitation of this vulnerability.
+search: '`splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200"  | table  splunk_server status uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`'
+how_to_implement: Requires access to internal index.
+known_false_positives: This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22942
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential CSRF exploitation attempt from $host$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: splunk_server
+      type: Hostname
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - splunk_server
+    - status
+    - uri
+    - delete_field_value
+    - method
+    - post_data
+  risk_score: 25
+  security_domain: threat

detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml

@@ -0,0 +1,57 @@
+name: Splunk Improperly Formatted Parameter Crashes splunkd
+id: 08978eca-caff-44c1-84dc-53f17def4e14
+version: 1
+date: "2023-02-14"
+author: Chase Franklin, Rod Soto, Splunk
+type: TTP
+datamodel:
+  - Endpoint
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, when the INGEST\\_EVAL parameter is improperly formatted, it crashes splunkd. This hunting search provides the user, timing and number of times the crashing command was executed.
+search:
+  '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"
+  AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc
+  Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info
+  Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type
+  | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`'
+how_to_implement: Requires access to audittrail and use of Splunk_Audit.Search_Activity datamodel.
+known_false_positives: This is a hunting search it should be focused on affected products, otherwise it is likely to produce false positives.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22941
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 100
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk_improperly_formatted_ingest_eval_parameter_crashes_splunkd_data.log
+  impact: 100
+  kill_chain_phases:
+    - Exploitation
+  message: An attempt to exploit ingest eval parameter was detected from $user$
+  mitre_attack_id:
+    - T1499
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Attacker
+  product:
+    - Splunk Enterprise
+  required_fields:
+    - user
+    - count
+    - info
+  risk_score: 100
+  security_domain: threat

detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml

@@ -0,0 +1,56 @@
+name: Persistent XSS in RapidDiag through User Interface Views
+id: ce6e1268-e01c-4df2-a617-0f034ed49a43
+version: 1
+date: "2023-02-14"
+author: Rod Soto, Splunk
+type: TTP
+datamodel: []
+description: In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0. This search provides information on what user may have potentially added a malicious payload and what users were exposed to it.
+search:
+  "`audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/*
+  action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`"
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index
+known_false_positives: This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22932
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: A potential XSS attempt has been detected from $user$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: User
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - user
+    - action
+    - roles
+    - info
+    - roles
+    - path
+  risk_score: 25
+  security_domain: threat

detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml

@@ -0,0 +1,62 @@
+name: Splunk risky Command Abuse disclosed february 2023
+id: ee69374a-d27e-4136-adac-956a96ff60fd
+version: 1
+date: "2023-02-14"
+author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
+type: Hunting
+datamodel: []
+description: In February 2023, Splunk disclosed several vulnerabilities affecting Splunk Enterprise commands deemed risky. The following hunting search includes the following commands and versions. Command 'createrss' (versions 8.1.13, 8.2.10), pivot (8.1.13,8.2.10,9.0.4), display.page.search.patterns.sensitivity(versions below 8.1.13,8.2.10,9.0.4), search_listener, map, collect (8.1.13,8.2.10,9.0.4). For more information please review Splunk Vulnerabilities Disclosure, February 2023. Link can be found in reference.
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command as search output splunk_risky_command description vulnerable_versions CVE other_metadata | where splunk_risky_command != "false" | `splunk_risky_command_abuse_disclosed_february_2023_filter`'
+how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel.
+known_false_positives: This search encompasses many commands.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22931
+    - CVE-2023-22934
+    - CVE-2023-22935
+    - CVE-2023-22936
+    - CVE-2023-22939
+    - CVE-2023-22940
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Use of risky splunk command $splunk_risky_command$ detected by $user$
+  mitre_attack_id:
+    - T1548
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Attacker
+    - name: splunk_risky_command
+      type: Other
+      role:
+        - Other
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - search
+    - info
+    - user
+    - search_type
+    - count
+  risk_score: 25
+  security_domain: threat

detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml

@@ -0,0 +1,61 @@
+name: Splunk unnecessary file extensions allowed by lookup table uploads
+id: b7d1293f-e78f-415e-b5f6-443df3480082
+version: 1
+date: "2023-02-14"
+author: Rod Soto, Splunk
+type: TTP
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table uploads let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now only be one of .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gz. This search provides user activity focus on uploads which aims to help hunt for malicious file uploads.
+search:
+  '`splunkda` method IN ("POST", "DELETE") uri_path=/servicesNS/*/ui/views/*
+  | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method=="DELETE" , "Deleted" )
+  | rex field=uri_path "(?<user_and_app>.*?)\/ui\/views/(?<dashboard_encoded>.*)"
+  | eval dashboard = urldecode( dashboard_encoded )
+  | table _time, uri_path, user, dashboard, activity, uri_path
+  | `splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter`'
+how_to_implement: Requires access to internal splunkd_access.
+known_false_positives: This is a hunting search, the search provides information on upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary after executing search. This search will produce false positives as payload cannot be directly discerned.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22937
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential lookup template injection attempt from $user$ on lookup table at path $uri_path$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: uri_path
+      type: Other
+      role:
+        - Other
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - user
+    - method
+    - uri_path
+  risk_score: 25
+  security_domain: threat

detections/application/splunk_xss_via_view.yml

@@ -0,0 +1,50 @@
+name: Splunk XSS via View
+id: 9ac2bfea-a234-4a18-9d37-6d747e85c2e4
+version: 1
+date: "2023-02-07"
+author: Rod Soto, Eric McGinnis, Splunk
+type: Hunting
+datamodel: []
+description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting in an XML View through the 'layoutPanel' attribute in the 'module' tag. The vulnerability affects instances with Splunk Web enabled. This hunting search shows users action, application and role used for creating views related to this vulnerability.
+search: index = _internal sourcetype IN ("splunk_web_service", "splunk_python") message="*loadParams*" | `security_content_ctime(_time)` |  table _time message fileName | `splunk_xss_via_view_filter`
+how_to_implement: This data is collected by default in Splunk.  Upon first enabling this rule, a number of errors may be observed. Those that are due to improperly formatted, but non-nefarious, XML views should be be remedied in the corresponding view. Please take care investigating potential XSS as accessing an affected page could retrigger the exploit.
+known_false_positives: The error detected above can be generated for a wide variety of improperly formatted XML views.  There will be false positives as the search cannot extract the malicious payload and the view should be manually investigated.
+references:
+  - https://www.splunk.com/en_us/product-security.html
+tags:
+  analytic_story:
+    - Splunk Vulnerabilities
+  asset_type: Endpoint
+  cve:
+    - CVE-2023-22933
+  cis20:
+    - CIS 3
+    - CIS 5
+    - CIS 16
+  confidence: 50
+  context:
+    - Source:Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log
+  impact: 50
+  kill_chain_phases:
+    - Exploitation
+  message: Potential stored XSS attempt via $fileName$
+  mitre_attack_id:
+    - T1189
+  nist:
+    - DE.CM
+  observable:
+    - name: fileName
+      type: URL
+      role:
+        - Target
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  required_fields:
+    - message
+    - fileName
+  risk_score: 25
+  security_domain: endpoint