ID | Technique | Tactic |
---|---|---|
T1189 | Drive-by Compromise | Initial Access |
Detection: Splunk XSS Privilege Escalation via Custom Urls in Dashboard
Description
This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges.
Search
1`splunkd_ui` method=POST /*/data/ui/views*
2| stats values(method) as method by _time index, sourcetype, host
3| eval event="post_request"
4| append [
5| search `audittrail` action="edit_user" operation="create"
6| rex field=_raw "object=\"(?<newUser>.*)\""
7| stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser
8| eval event="create_user"]
9| sort - _time
10| transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m
11| table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount
12| `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
Splunk | Splunk | 'splunkd_ui_access' |
'splunkd_ui_access.log' |
N/A |
Macros Used
Name | Value |
---|---|
audittrail | index=_audit sourcetype=audittrail |
splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter | search * |
splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | False |
Implementation
Requires access to internal indexes _audit and _internal.
Known False Positives
This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Possible XSS attack and privilege escalation via custom urls in dashboard against $host$ | 5 | 10 | 50 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | /opt/splunk/var/log/splunk/splunkd_ui_access.log |
splunkd_ui_access |
Integration | ✅ Passing | Dataset | /opt/splunk/var/log/splunk/splunkd_ui_access.log |
splunkd_ui_access |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 1