Try in Splunk Security Cloud

Description

This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges.

  • Type: Hunting

  • Product: Splunk Enterprise

  • Last Updated: 2024-07-01
  • Author: Rod Soto, Chase Franklin
  • ID: 01e1e386-7656-4f36-a55a-52fe39b04a96

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1189 Drive-by Compromise Initial Access
Kill Chain Phase
  • Delivery
NIST
  • DE.AE
CIS20
  • CIS 10
CVE
ID Summary CVSS
    


1
2
3
4
5
6
7
8
9
10
11
12



`splunkd_ui` method=POST /*/data/ui/views* 
| stats values(method) as method by _time index, sourcetype, host 
| eval event="post_request" 
| append [
| search `audittrail` action="edit_user" operation="create" 
| rex field=_raw "object=\"(?<newUser>.*)\"" 
| stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser 
| eval event="create_user"] 
| sort - _time 
| transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m 
| table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount 
| `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`

Macros

The SPL above uses the following Macros:

:information_source: splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • method
  • host
  • action
  • operation
  • splunk_server
  • user

How To Implement

Requires access to internal indexes _audit and _internal.

Known False Positives

This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
5.0 10 50 Possible XSS attack and privilege escalation via custom urls in dashboard against $host$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1