ID | Technique | Tactic |
---|---|---|
T1083 | File and Directory Discovery | Discovery |
Detection: Path traversal SPL injection
Description
The following analytic identifies attempts at path traversal in search parameters, which can lead to SPL injection. It detects this activity by searching for specific patterns in the _internal
index that indicate path traversal attempts (e.g., "../../../../"). This activity is significant for a SOC because it can allow an attacker to manipulate the application to load data from incorrect endpoints, potentially running arbitrary SPL queries. If confirmed malicious, this could lead to unauthorized data access, code execution, or further exploitation of the Splunk environment.
Search
1`path_traversal_spl_injection`
2| search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/"
3| stats count by host status clientip method uri_path uri_query
4| `path_traversal_spl_injection_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
Splunk | Splunk | 'splunkd_ui_access' |
'splunkd_ui_access.log' |
N/A |
Macros Used
Name | Value |
---|---|
path_traversal_spl_injection | index=_internal sourcetype=splunkd_ui_access |
path_traversal_spl_injection_filter | search * |
path_traversal_spl_injection_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
Known False Positives
This search may find additional path traversal exploitation attempts.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Path traversal exploitation attempt from $clientip$ | 40 | 50 | 80 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | splunkd_ui_access.log |
splunkd_ui_access |
Integration | ✅ Passing | Dataset | splunkd_ui_access.log |
splunkd_ui_access |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 4