Try in Splunk Security Cloud

Description

The following analytic identifies low-privilege users attempting to view hashed Splunk passwords by querying the conf-user-seed REST endpoint. It leverages data from the splunkd_web logs, specifically monitoring access to the conf-user-seed endpoint. This activity is significant because it can indicate an attempt to escalate privileges by obtaining hashed credentials, potentially leading to admin account takeover. If confirmed malicious, this could allow an attacker to gain administrative control over the Splunk instance, compromising the entire environment's security.

  • Type: Hunting

  • Product: Splunk Enterprise

  • Last Updated: 2024-05-29
  • Author: Rod Soto, Eric McGinnis, Chase Franklin
  • ID: a1be424d-e59c-4583-b6f9-2dcc23be4875

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1212 Exploitation for Credential Access Credential Access
Kill Chain Phase
  • Exploitation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4



`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" 
| stats earliest(_time) as event_time values(method) as method values(status) as status values(clientip) as clientip values(useragent) as useragent values(file) as file by user 
| convert ctime(*time) 
| `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`

Macros

The SPL above uses the following Macros:

:information_source: splunk_low_privilege_user_can_view_hashed_splunk_password_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • clientip
  • useragent
  • file
  • user
  • method
  • status

How To Implement

This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content.

Known False Positives

This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
81.0 90 90 Attempt to access Splunk hashed password file from $clientip$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2