Splunk RCE PDFgen Render

Try in Splunk Security Cloud

Description

This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote

• Type: TTP

• Product: Splunk Enterprise

• Last Updated: 2024-07-01
• Author: Rod Soto, Chase Franklin
• ID: bc2b7437-0400-438b-9537-21ab5b7d2d53

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1210	Exploitation of Remote Services	Lateral Movement

Kill Chain Phase

• Exploitation

NIST

• DE.CM

CIS20

• CIS 10

CVE

ID	Summary	CVSS

Search

index=_internal sourcetype=splunk_pdfgen _raw IN ("*base64*", "*lambda*", "*system*") 
| stats count min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host, _raw 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `splunk_rce_pdfgen_render_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime

splunk_rce_pdfgen_render_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• host

How To Implement

Requires access to internal indexes.

Known False Positives

This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives.

Associated Analytic Story

• Splunk Vulnerabilities

RBA

Risk Score	Impact	Confidence	Message
80.0	80	100	Possible exploitation against $host$

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://advisory.splunk.com/advisories/SVD-2024-0701

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1