Skip to content

Commit fb7346f

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3023 from splunk/gitlab_release_v4.35.0
Release v4.35.0
2 parents 3e64dfb + fb20d89 commit fb7346f

File tree

88 files changed

+1479
-136
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

88 files changed

+1479
-136
lines changed

‎app_template/default/data/ui/views/escu_summary.xml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,13 @@
2222
<row>
2323
<panel>
2424
<html>
25-
<h2 style="color:red">Explore the Analytic Stories included with Splunk Security via <a href="https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html">ES Use Case Library</a> or <a href="https://splunkbase.splunk.com/app/3435/">Splunk Security Essentials</a>.</h2>
25+
<div style="background-color: #f8d7da; border: 1px solid #f5c6cb; border-radius: 5px; padding: 15px; margin-bottom: 20px;">
26+
<h2 style="color: #721c24; margin: 0;">
27+
<i class="icon-info-circle" style="margin-right: 10px;"></i>
28+
Explore Splunk Security Content using
29+
<a href="/app/SplunkEnterpriseSecuritySuite/ess_use_case_library" style="color: #721c24; text-decoration: underline;">Splunk Enterprise Security</a>
30+
</h2>
31+
</div>
2632
</html>
2733
</panel>
2834
</row>

‎contentctl.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ app:
33
uid: 3449
44
title: ES Content Updates
55
appid: DA-ESS-ContentUpdate
6-
version: 4.34.0
6+
version: 4.35.0
77
description: Explore the Analytic Stories included with ES Content Updates.
88
prefix: ESCU
99
label: ESCU

‎detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
name: Splunk csrf in the ssg kvstore client endpoint
1+
name: Splunk CSRF in the SSG kvstore Client Endpoint
22
id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410
3-
version: 2
4-
date: '2024-05-11'
3+
version: 3
4+
date: '2024-07-01'
55
author: Rod Soto
66
status: production
77
type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies attempts to exploit a cross-site
1515
information, compromising the integrity and security of the Splunk environment.
1616
data_source:
1717
- Splunk
18-
search: '`splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET"
18+
search: '`splunkda` uri_path="/*/splunkd/__raw/services/ssg/kvstore_client" method="GET"
1919
delete_field_value="spacebridge_server" status="200" | table splunk_server status
2020
uri delete_field_value method post_data | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`'
2121
how_to_implement: Requires access to internal index.
@@ -24,7 +24,7 @@ known_false_positives: This hunting search only applies to the affected versions
2424
it requires manual investigation after executing search. This search will produce
2525
false positives.
2626
references:
27-
- https://www.splunk.com/en_us/product-security.html
27+
- https://advisory.splunk.com/advisories/SVD-2023-0212
2828
tags:
2929
analytic_story:
3030
- Splunk Vulnerabilities

‎detections/application/splunk_dos_via_post_request_datamodel_endpoint.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Splunk DoS via POST Request Datamodel Endpoint
2+
id: 45766810-dbb2-44d4-b889-b4ba3ee0d1f5
3+
version: 1
4+
status: production
5+
date: '2024-07-01'
6+
author: Rod Soto
7+
type: Hunting
8+
data_source: []
9+
description: The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint.
10+
search: >-
11+
`splunkd_webs` log_level=INFO message="ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('127.0.0.1', 8065)) shut down"
12+
| stats count min(_time) as firstTime max(_time) as lastTime by splunk_server message
13+
| `security_content_ctime(firstTime)`
14+
| `security_content_ctime(lastTime)`
15+
| `splunk_dos_via_post_request_datamodel_endpoint_filter`
16+
how_to_implement: Need access to the internal indexes.
17+
known_false_positives: This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs.
18+
references:
19+
- https://advisory.splunk.com/advisories/SVD-2024-0710
20+
cve:
21+
- CVE-2024-36986
22+
tags:
23+
analytic_story:
24+
- Splunk Vulnerabilities
25+
asset_type: Splunk Server
26+
cis20:
27+
- CIS 3
28+
- CIS 5
29+
- CIS 16
30+
confidence: 50
31+
impact: 100
32+
kill_chain_phases:
33+
- Exploitation
34+
message: Possible Denial of Service attack against $splunk_server$
35+
mitre_attack_id:
36+
- T1499
37+
nist:
38+
- DE.CM
39+
observable:
40+
- name: splunk_server
41+
type: Hostname
42+
role:
43+
- Victim
44+
product:
45+
- Splunk Enterprise
46+
required_fields:
47+
- UPDATE
48+
risk_score: 15
49+
security_domain: endpoint
50+
tests:
51+
- name: True Positive Test
52+
attack_data:
53+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0710_web_service_splunk_web_service.log
54+
source: /opt/splunk/var/log/splunk/web_service.log
55+
sourcetype: splunk_web_service
56+
custom_index: _internal

‎detections/application/splunk_enterprise_windows_deserialization_file_partition.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Splunk Enterprise Windows Deserialization File Partition
22
id: 947d4d2e-1b64-41fc-b32a-736ddb88ce97
3-
version: 2
4-
date: '2024-05-18'
3+
version: 3
4+
date: '2024-07-01'
55
author: Rod Soto, Eric McGinnis, Chase Franklin
66
status: production
77
type: TTP
@@ -15,7 +15,7 @@ description: The following analytic identifies attempts to exploit a deserializa
1515
If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary
1616
code, and potentially compromise the entire Splunk environment, leading to data
1717
breaches and further system exploitation.
18-
search: '`splunk_python` request_path="/en-US/app/search/C:\\Program" *strings* |
18+
search: '`splunk_python` request_path="/*/app/search/C:\\Program" *strings* |
1919
rex "request_path=(?<file_path>[^\"]+)" | rex field=file_path "[^\"]+/(?<file_name>[^\"\''\s/\\\\]+)"
2020
| stats min(_time) as firstTime max(_time) as lastTime values(file_path) as file_path
2121
values(file_name) as file_name by index, sourcetype, host | `security_content_ctime(firstTime)`

‎detections/application/splunk_information_disclosure_on_account_login.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Splunk Information Disclosure on Account Login
2+
id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c
3+
version: 1
4+
date: '2024-07-01'
5+
author: Rod Soto
6+
status: production
7+
type: Hunting
8+
data_source:
9+
- Splunk
10+
description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server.
11+
search: '`splunkd` component=UiAuth status=failure action=login TcpChannelThread
12+
| stats count min(_time) as firstTime max(_time) as lastTime by user status action clientip
13+
| `security_content_ctime(firstTime)`
14+
| `security_content_ctime(lastTime)`
15+
| `splunk_information_disclosure_on_account_login_filter`'
16+
how_to_implement: Requires access to internal indexes _internal.
17+
known_false_positives: This is a hunting search and requires operator to search for large number of login failures from several users indicating possible user enumeration attempts. May capture genuine login failures.
18+
references:
19+
- https://advisory.splunk.com/SVD-2024-0716
20+
cve:
21+
- CVE-2024-36996
22+
tags:
23+
analytic_story:
24+
- Splunk Vulnerabilities
25+
asset_type: Splunk Server
26+
cis20:
27+
- CIS 3
28+
- CIS 5
29+
- CIS 16
30+
confidence: 50
31+
impact: 10
32+
kill_chain_phases:
33+
- Exploitation
34+
message: Possible user enumeration attack against $clientip$
35+
mitre_attack_id:
36+
- T1087
37+
nist:
38+
- DE.CM
39+
observable:
40+
- name: clientip
41+
type: Hostname
42+
role:
43+
- Victim
44+
product:
45+
- Splunk Enterprise
46+
required_fields:
47+
- user
48+
- action
49+
- status
50+
- clientip
51+
- host
52+
risk_score: 5
53+
security_domain: endpoint
54+
tests:
55+
- name: True Positive Test
56+
attack_data:
57+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/splunk/SVD-2024-0716_splunkd_splunkd.log
58+
source: /opt/splunk/var/log/splunk/splunkd.log
59+
sourcetype: splunkd
60+
custom_index: _internal

‎detections/application/splunk_rce_pdfgen_render.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Splunk RCE PDFgen Render
2+
id: bc2b7437-0400-438b-9537-21ab5b7d2d53
3+
version: 1
4+
date: '2024-07-01'
5+
status: production
6+
author: Rod Soto, Chase Franklin
7+
type: TTP
8+
data_source:
9+
- Splunk
10+
description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote
11+
search: 'index=_internal sourcetype=splunk_pdfgen _raw IN ("*base64*", "*lambda*", "*system*")
12+
| stats count min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host, _raw
13+
| `security_content_ctime(firstTime)`
14+
| `security_content_ctime(lastTime)`
15+
| `splunk_rce_pdfgen_render_filter`'
16+
how_to_implement: Requires access to internal indexes.
17+
known_false_positives: This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives.
18+
references:
19+
- https://advisory.splunk.com/advisories/SVD-2024-0701
20+
cve:
21+
- CVE-2024-36982
22+
tags:
23+
analytic_story:
24+
- Splunk Vulnerabilities
25+
asset_type: Splunk Server
26+
cis20:
27+
- CIS 3
28+
- CIS 5
29+
- CIS 16
30+
confidence: 100
31+
impact: 80
32+
kill_chain_phases:
33+
- Exploitation
34+
message: Possible exploitation against $host$
35+
mitre_attack_id:
36+
- T1210
37+
nist:
38+
- DE.CM
39+
observable:
40+
- name: host
41+
type: Hostname
42+
role:
43+
- Victim
44+
product:
45+
- Splunk Enterprise
46+
required_fields:
47+
- host
48+
risk_score: 80
49+
security_domain: endpoint
50+
tests:
51+
- name: True Positive Test
52+
attack_data:
53+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0701_pdfgen_log_splunk_pdfgen.log
54+
source: /opt/splunk/var/log/splunk/pdfgen.log
55+
sourcetype: splunk_pdfgen
56+
custom_index: _internal
57+

‎detections/application/splunk_rce_via_external_lookup_copybuckets.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Splunk RCE via External Lookup Copybuckets
2+
id: 8598f9de-bba8-42a4-8ef0-12e1adda4131
3+
version: 1
4+
date: '2024-07-01'
5+
status: production
6+
author: Rod Soto, Chase Franklin
7+
type: Hunting
8+
data_source:
9+
- Splunk
10+
description: The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup.
11+
search: 'index=_internal sourcetype="splunk_archiver-too_small" *.csv
12+
| rex field=_raw "Invoking command:\s(?<command>.*)"
13+
| stats min(_time) as firstTime max(_time) as lastTime values(command) as command values(severity) as severity by host
14+
| `security_content_ctime(firstTime)`
15+
| `security_content_ctime(lastTime)`
16+
| `splunk_rce_via_external_lookup_copybuckets_filter`'
17+
how_to_implement: Requires access to internal indexes
18+
known_false_positives: An operator must identify elements indicatives of command execution requests by looking at regex data being extracted from the log. Not all the requests will be malicious.
19+
references:
20+
- https://advisory.splunk.com/advisories/SVD-2024-0705
21+
tags:
22+
analytic_story:
23+
- Splunk Vulnerabilities
24+
asset_type: Splunk Server
25+
cis20:
26+
- CIS 3
27+
- CIS 5
28+
- CIS 16
29+
confidence: 100
30+
impact: 80
31+
kill_chain_phases:
32+
- Exploitation
33+
message: Possible exploitation attempt against $host$
34+
mitre_attack_id:
35+
- T1210
36+
nist:
37+
- DE.CM
38+
observable:
39+
- name: host
40+
type: Hostname
41+
role:
42+
- Victim
43+
product:
44+
- Splunk Enterprise
45+
required_fields:
46+
- host
47+
risk_score: 80
48+
security_domain: endpoint
49+
tests:
50+
- name: True Positive Test
51+
attack_data:
52+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0705_splunk_archiver_splunk_archiver-too_small.log
53+
source: /opt/splunk/var/log/splunk/splunk_archiver.log
54+
sourcetype: splunk_archiver-too_small
55+
update_timestamp: true
56+
custom_index: _internal

‎detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Splunk risky Command Abuse disclosed february 2023
22
id: ee69374a-d27e-4136-adac-956a96ff60fd
3-
version: 3
4-
date: '2024-05-05'
3+
version: 4
4+
date: '2024-07-01'
55
author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
66
status: production
77
type: Hunting
@@ -26,7 +26,7 @@ search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time)
2626
how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel.
2727
known_false_positives: This search encompasses many commands.
2828
references:
29-
- https://www.splunk.com/en_us/product-security.html
29+
- https://advisory.splunk.com/advisories
3030
tags:
3131
analytic_story:
3232
- Splunk Vulnerabilities
@@ -43,6 +43,7 @@ tags:
4343
- CVE-2023-40598
4444
- CVE-2023-46214
4545
- CVE-2024-23676
46+
- CVE-2024-36984
4647
impact: 50
4748
message: Use of risky splunk command $splunk_risky_command$ detected by $user$
4849
mitre_attack_id:

‎detections/application/splunk_stored_xss_conf_web_settings_on_premises.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Splunk Stored XSS conf-web Settings on Premises
2+
id: ed1209ef-228d-4dab-9856-be9369925a5c
3+
version: 1
4+
date: '2024-07-01'
5+
author: Rod Soto, Chase Franklin
6+
status: production
7+
type: Hunting
8+
data_source:
9+
- Splunk
10+
description: This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user.
11+
search: '`splunk_python` *script* *eval*
12+
| stats min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host
13+
| `security_content_ctime(firstTime)`
14+
| `security_content_ctime(lastTime)`
15+
| `splunk_stored_xss_conf_web_settings_on_premises_filter`'
16+
how_to_implement: Requires access to internal indexes.
17+
known_false_positives: This is a hunting search and will produce false positives, operator must identify XSS elemetns in the splunk_python log related to the vulnerable endpoint.
18+
references:
19+
- https://advisory.splunk.com/advisories/SVD-2024-0717
20+
cve:
21+
- CVE-2024-36987
22+
tags:
23+
analytic_story:
24+
- Splunk Vulnerabilities
25+
asset_type: Splunk Server
26+
cis20:
27+
- CIS 3
28+
- CIS 5
29+
- CIS 16
30+
confidence: 100
31+
impact: 20
32+
kill_chain_phases:
33+
- Exploitation
34+
message: Possible XSS attack against $host$
35+
mitre_attack_id:
36+
- T1189
37+
nist:
38+
- DE.CM
39+
observable:
40+
- name: host
41+
type: Hostname
42+
role:
43+
- Victim
44+
product:
45+
- Splunk Enterprise
46+
required_fields:
47+
- UPDATE
48+
risk_score: 20
49+
security_domain: endpoint
50+
tests:
51+
- name: True Positive Test
52+
attack_data:
53+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0717_python_log_splunk_python.log
54+
source: /opt/splunk/var/log/splunk/python.log
55+
sourcetype: splunk_python
56+
custom_index: _internal
57+

0 commit comments

Comments
 (0)