From b5a88d52587903db5b190fe66f72cb22725bb00d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 10 Jul 2026 01:45:31 +0530 Subject: [PATCH] hotfix --- ..._rce_through_arbitrary_file_write_to_windows_system_root.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml index 74c716a688..21114c3d1f 100644 --- a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml +++ b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml @@ -6,7 +6,7 @@ modification_date: '2026-06-23' author: Rod Soto status: production type: Hunting -description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration. +description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration data_source: - Splunk search: |-