Try in Splunk Security Cloud

Description

The following analytic is designed to detect potential exploitation attempts on publicly accessible PaperCut NG servers. It identifies connections from public IP addresses to the server and specifically monitors for URI paths commonly found in proof-of-concept (POC) scripts for exploiting PaperCut NG vulnerabilities. These URI paths have been observed in both Metasploit modules and standalone scripts used for attacking PaperCut NG servers. When a public IP address is detected accessing one or more of these suspicious URI paths, an alert may be generated to notify the security team of the potential threat. The team can then investigate the source IP address, the targeted PaperCut NG server, and any other relevant information to determine the nature of the activity and take appropriate actions to mitigate the risk.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Web
  • Last Updated: 2023-05-15
  • Author: Michael Haag, Splunk
  • ID: 9fcb214a-dc42-4ce7-a650-f1d2cab16a6a

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1190 Exploit Public-Facing Application Initial Access
T1133 External Remote Services Persistence, Initial Access
Kill Chain Phase
  • Delivery
  • Installation
NIST
  • DE.CM
CIS20
  • CIS 13
CVE 


1
2
3
4
5
6



| tstats count from datamodel=Web where Web.url IN ("/app?service=page/SetupCompleted", "/app", "/app?service=page/PrinterList", "/app?service=direct/1/PrinterList/selectPrinter&sp=*", "/app?service=direct/1/PrinterDetails/printerOptionsTab.tab") NOT (src IN ("10.*.*.*","172.16.*.*", "192.168.*.*", "169.254.*.*", "127.*.*.*", "fc00::*", "fd00::*", "fe80::*")) by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.dest_port sourcetype 
| `drop_dm_object_name("Web")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `papercut_ng_remote_web_access_attempt_filter`

Macros

The SPL above uses the following Macros:

:information_source: papercut_ng_remote_web_access_attempt_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • Web.http_user_agent
  • Web.http_method
  • Web.url
  • Web.url_length
  • Web.src
  • Web.dest
  • sourcetype

How To Implement

To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the Web datamodel.

Known False Positives

False positives may be present, filter as needed.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
63.0 90 70 URIs specific to PaperCut NG have been access by a public IP against $dest$.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1