ID | Technique | Tactic |
---|---|---|
T1498 | Network Denial of Service | Impact |
Detection: Splunk DoS Using Malformed SAML Request
Description
The following analytic detects a denial of service (DoS) attempt using a malformed SAML request targeting the /saml/acs REST endpoint in Splunk Enterprise versions lower than 9.0.6 and 8.2.12. It leverages splunkd
logs, specifically looking for error messages containing "xpointer" in the expr
field. This activity is significant because it can cause the Splunk daemon to crash or hang, disrupting service availability. If confirmed malicious, this attack could lead to prolonged downtime, impacting the organization's ability to monitor and respond to security events.
Search
1`splunkd` event_message=*error* expr=*xpointer*
2| stats count min(_time) as firstTime max(_time) as lastTime by component expr splunk_server event_message
3| `security_content_ctime(firstTime)`
4| `security_content_ctime(lastTime)`
5| `splunk_dos_using_malformed_saml_request_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
Splunk | Splunk | 'splunkd_ui_access' |
'splunkd_ui_access.log' |
N/A |
Macros Used
Name | Value |
---|---|
security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
splunk_dos_using_malformed_saml_request_filter | search * |
splunk_dos_using_malformed_saml_request_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | False |
Implementation
To run this search, you must have access to the _internal index.
Known False Positives
This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Possible DoS attack against Splunk Server $splunk_server$ | 15 | 50 | 30 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | splunkd.log |
splunkd |
Integration | ✅ Passing | Dataset | splunkd.log |
splunkd |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2