Detection: Splunk RCE Through Arbitrary File Write to Windows System Root

 1```Each exploit attempt abuses the following endpoint. A request to the endpoint MUST occur immediately before the App Creation Message. However, this endpoint does not expose the name of the app that was created```
 2`splunkda` status=200 uri_path="*/search/apps/local/_new"
 3
 4| bin _time span=1m 
 5| stats count by _time, user
 6``` A request to this endpoint also results in an ApplicationManager event showing that a new application was created. This exposes the name and is created immediately following the initial request.  We will look for these creation messages up to 60 seconds after the request to the vulnerable endpoint.```
 7
 8| eval earliest_app_creation_time=_time
 9
10| eval latest_app_creation_time=_time+60
11
12| eval api_user=user
13```Search for the names of apps that were created with the time bounds above```
14
15| map maxsearches=150 search="search index=_internal earliest=$earliest_app_creation_time$ latest=$latest_app_creation_time$ 
16```Admins, or users with app creation privileges may abuse this command```
17(sourcetype=splunkd component=ApplicationManager event_message=\"Detected app creation:*\") OR 
18```But the command may also be abused by users with lower privileges```
19(sourcetype=splunk_python user=$api_user$ type=ERROR \"requires capability\" AND (\"edit_local_apps\" OR \"admin_all_objects\")) 
20```Create meaningful messages in the case that app creation was successful or if it failed```
21
22| strcat event_message \" - This app should be examined to ensure that it is legitimate.\" message_if_app_creation_successful
23
24| strcat event_message \"Detected failed app creation: user does not have admin_all_objects or edit_local_apps capability and the user account MUST be investigated. This may still have resulted in the upload of malicious file(s) or execution of maliciouis command(s).\" message_if_app_creation_failed
25
26| eval message=if(isnull(event_message), message_if_app_creation_failed, message_if_app_creation_successful ) 
27
28| eval user=\"$api_user$\""
29
30| stats count min(_time) as firstTime max(_time) as lastTime by user, message, host
31
32| `security_content_ctime(firstTime)`
33
34| `security_content_ctime(lastTime)`
35
36| `splunk_rce_through_arbitrary_file_write_to_windows_system_root_filter`