Try in Splunk Security Cloud

Description

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.

  • Type: Hunting
  • Product: Splunk Enterprise

  • Last Updated: 2023-05-09
  • Author: Rod Soto, Eric McGinnis, Chase Franklin
  • ID: a1be424d-e59c-4583-b6f9-2dcc23be4875

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1212 Exploitation for Credential Access Credential Access
Kill Chain Phase
  • Exploitation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE
1
2
3
4
`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" 
| stats earliest(_time) as event_time values(method) as method values(status) as status values(clientip) as clientip values(useragent) as useragent values(file) as file by user 
| convert ctime(*time) 
| `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`

Macros

The SPL above uses the following Macros:

:information_source: splunk_low_privilege_user_can_view_hashed_splunk_password_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • clientip
  • useragent
  • file
  • user
  • method
  • status

How To Implement

This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content.

Known False Positives

This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
81.0 90 90 Attempt to access Splunk hashed password file from $clientip$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1