Splunk Vuln content to Github (#4134)

* move from gitlab

* moving removed from gitlab

* udpating versions due to removal of whitespace

* UTC is 23

* deprecate content

* bump ver

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

Author: patel-bhavin

.gitignore

@@ -13,6 +13,7 @@ dist/ContentPack-*.appinspect_api_results.html
 dist/ContentPack-*.appinspect_api_results.json
 atomic-red-team/
 external_repos/
+schemas/
 
 # IDE
 .vscode/

detections/application/splunk_authentication_token_exposure_in_debug_log.yml

@@ -0,0 +1,70 @@
+name: Splunk Authentication Token Exposure in Debug Log
+id: 9a67e749-d291-40dd-8376-d422e7ecf8b5
+version: 9
+creation_date: '2024-03-27'
+modification_date: '2026-06-24'
+author: Rod Soto, Chase Franklin
+status: production
+type: TTP
+description: |-
+    The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise.
+    It leverages logs from the `splunkd` component with a DEBUG log level, specifically searching for event messages that validate tokens. This activity is significant because exposed tokens can be exploited by attackers to gain unauthorized access to the Splunk environment.
+    If confirmed malicious, this exposure could lead to unauthorized data access, privilege escalation, and potential compromise of the entire Splunk infrastructure.
+    Monitoring and addressing this vulnerability is crucial for maintaining the security and integrity of the Splunk deployment.
+data_source: []
+search: |-
+    `splunkd`
+    component=JsonWebToken
+    log_level=DEBUG
+    eventtype="splunkd-log"
+    event_message="Validating token:*"
+    | rex "Validating token: (?<token>.*)\.$"
+    | search token!=None
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+                  values(log_level) as log_level
+                  values(event_message) as event_message
+      by index, sourcetype, host, token
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `splunk_authentication_token_exposure_in_debug_log_filter`
+how_to_implement: Requires access to internal Splunk indexes.
+known_false_positives: Only applies to affected versions of Splunk Enterprise below 9.2.1, 9.1.4, and 9.0.9
+references:
+    - https://advisory.splunk.com/advisories/SVD-2024-0301
+drilldown_searches:
+    - name: View the detection results for $host$
+      search: '%original_detection_search% | search  host = $host$'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for $host$
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+finding:
+    title: Possible JsonWebToken exposure, please investigate affected $host$
+    entity:
+        field: host
+        type: system
+        score: 50
+analytic_story:
+    - Splunk Vulnerabilities
+asset_type: Splunk Server
+cve:
+    - CVE-2024-29945
+mitre_attack_id:
+    - T1654
+product:
+    - Splunk Enterprise
+    - Splunk Cloud
+    - Splunk Enterprise Security
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log
+          source: /opt/splunk/var/log/splunk/splunkd.log
+          sourcetype: splunkd
+          index: _internal
+      test_type: unit

detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml

@@ -0,0 +1,80 @@
+name: Splunk RCE Through Arbitrary File Write to Windows System Root
+id: c97e0704-d9c6-454d-89ba-1510a987bf72
+version: 7
+creation_date: '2024-10-14'
+modification_date: '2026-06-23'
+author: Rod Soto
+status: production
+type: Hunting
+description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration.
+data_source:
+    - Splunk
+search: |-
+    ```Each exploit attempt abuses the following endpoint. A request to the endpoint MUST occur immediately before the App Creation Message. However, this endpoint does not expose the name of the app that was created```
+    `splunkda` status=200 uri_path="*/search/apps/local/_new"
+    | bin _time span=1m | stats count by _time, user
+    ``` A request to this endpoint also results in an ApplicationManager event showing that a new application was created. This exposes the name and is created immediately following the initial request.  We will look for these creation messages up to 60 seconds after the request to the vulnerable endpoint.```
+    | eval earliest_app_creation_time=_time
+    | eval latest_app_creation_time=_time+60
+    | eval api_user=user
+    ```Search for the names of apps that were created with the time bounds above```
+    | map maxsearches=150 search="search index=_internal earliest=$earliest_app_creation_time$ latest=$latest_app_creation_time$
+    ```Admins, or users with app creation privileges may abuse this command```
+    (sourcetype=splunkd component=ApplicationManager event_message=\"Detected app creation:*\") OR
+    ```But the command may also be abused by users with lower privileges```
+    (sourcetype=splunk_python user=$api_user$ type=ERROR \"requires capability\" AND (\"edit_local_apps\" OR \"admin_all_objects\"))
+    ```Create meaningful messages in the case that app creation was successful or if it failed```
+    | strcat event_message \" - This app should be examined to ensure that it is legitimate.\" message_if_app_creation_successful
+    | strcat event_message \"Detected failed app creation: user does not have admin_all_objects or edit_local_apps capability and the user account MUST be investigated. This may still have resulted in the upload of malicious file(s) or execution of maliciouis command(s).\" message_if_app_creation_failed
+    | eval message=if(isnull(event_message), message_if_app_creation_failed, message_if_app_creation_successful )
+    | eval user=\"$api_user$\""
+    | stats count min(_time) as firstTime max(_time) as lastTime by user, message, host
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `splunk_rce_through_arbitrary_file_write_to_windows_system_root_filter`
+how_to_implement: This search requires access to the _internal index and only applies Splunk Enterprise installations on Microsoft Windows. Apps, messages, and/or users reported by the search should be analyzed to see if they are legitimate.
+known_false_positives: This search may produce false positives as it is not possible to analyze the contents of an App Creation. This only applies to Splunk installations on Microsoft Windows where installation is placed on a different root directory like e or d.
+references:
+    - https://advisory.splunk.com/advisories/SVD-2024-1001
+    - https://advisory.splunk.com/advisories/SVD-2024-1003
+analytic_story:
+    - Splunk Vulnerabilities
+asset_type: Splunk Server
+cve:
+    - CVE-2024-45731
+    - CVE-2024-45733
+mitre_attack_id:
+    - T1210
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test SVD 1001
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunkd.log
+          sourcetype: splunkd
+          source: D:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd.log
+          index: _internal
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunkd_access.log
+          sourcetype: splunkd_access
+          source: D:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd_access.log
+          index: _internal
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunk_python.log
+          sourcetype: splunk_python
+          source: D:\\Program Files\\Splunk\\var\\log\\splunk\\python.log
+          index: _internal
+      test_type: unit
+    - name: True Positive Test SVD 1003
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1003-index_internal_sourcetype_splunkd_access.log
+          sourcetype: splunkd_access
+          source: C:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd_access.log
+          index: _internal
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1003-index_internal_sourcetype_splunk_python.log
+          sourcetype: splunk_python
+          source: C:\\Program Files\\Splunk\\var\\log\\splunk\\python.log
+          index: _internal
+      test_type: unit

detections/application/splunk_rce_via_user_xslt.yml

@@ -0,0 +1,36 @@
+name: Splunk RCE via User XSLT
+id: 6cb7e011-55fb-48e3-a98d-164fa854e37e
+version: 7
+creation_date: '2023-11-22'
+modification_date: '2026-05-14'
+author: Marissa Bower, Chase Franklin, Rod Soto, Bhavin Patel, Eric McGinnis, Splunk
+status: production
+type: Hunting
+description: The following analytic identifies potential remote code execution (RCE) attempts via user-supplied Extensible Stylesheet Language Transformations (XSLT) in Splunk versions 9.1.x. It detects this activity by analyzing `splunkd_ui` logs for specific URI patterns and status codes indicative of XSLT injection attempts. This activity is significant because successful exploitation could allow an attacker to execute arbitrary code on the Splunk server. If confirmed malicious, this could lead to full system compromise, unauthorized data access, and further lateral movement within the network.
+data_source: []
+search: '`splunkd_ui` ((uri="*NO_BINARY_CHECK=1*" AND "*input.path=*.xsl*") OR uri="*dispatch*.xsl*") AND uri!= "*splunkd_ui*" | rex field=uri "(?<string>=\s*([\S\s]+))" | eval decoded_field=urldecode(string) | eval action=case(match(status,"200"),"Allowed",match(status,"303|500|401|403|404|301|406"),"Blocked",1=1,"Unknown") | stats count min(_time) as firstTime max(_time) as lastTime by clientip useragent uri decoded_field action host | rename clientip as src, uri as dest_uri | iplocation src | fillnull value="N/A" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime, lastTime src, useragent, action, count, Country, Region, City, dest_uri, decoded_field | `splunk_rce_via_user_xslt_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+known_false_positives: This search will provide information for investigation and hunting possible abuse of user-supplied XSLT. There may be false positives and results should individually evaluated. Please evaluate the source IP and useragent responsible for creating the requests.
+references:
+    - https://advisory.splunk.com/advisories/SVD-2023-1104
+analytic_story:
+    - Splunk Vulnerabilities
+asset_type: Endpoint
+cve:
+    - CVE-2023-46214
+mitre_attack_id:
+    - T1210
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_user_xslt_splunkd_ui_access.log
+          source: /opt/splunk/var/log/splunk/splunkd_ui_access.log
+          sourcetype: splunkd_ui_access
+          index: _internal
+      test_type: unit

detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml

@@ -0,0 +1,60 @@
+name: Splunk Sensitive Information Disclosure in DEBUG Logging Channels
+id: 93dc7182-c5da-4085-82ec-401abf33d623
+version: 6
+creation_date: '2024-10-14'
+modification_date: '2026-05-14'
+author: Rod Soto, Eric McGinnis, Splunk
+status: production
+type: Hunting
+description: In Splunk versions 9.3, 9.2, 9.1, 9.1.5 Applications which have been enabled with logging level DEBUG may write sensitive information such as keys, tokens, or other sensitive strings into the internal index.
+data_source:
+    - Splunk
+search: |-
+    `splunkd` log_level="DEBUG" AND component IN ("REST_Calls", "AdminManager", "JSONWebToken")
+    | stats count min(_time) as firstTime max(_time) as lastTime by host splunk_server log_level component event_message
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `splunk_sensitive_information_disclosure_in_debug_logging_channels_filter`
+how_to_implement: Requires access to _internal index. It is recommended to inventory and modify the search for specific apps that may have DEBUG logging enabled.
+known_false_positives: There will be false positives as not every message to the DEBUG log will expose sensitive information, such as keys or other secrets.
+references:
+    - https://advisory.splunk.com/advisories/SVD-2024-0301
+    - https://advisory.splunk.com/advisories/SVD-2024-1008
+    - https://advisory.splunk.com/advisories/SVD-2024-1009
+analytic_story:
+    - Splunk Vulnerabilities
+asset_type: Splunk Server
+cve:
+    - CVE-2024-29945
+    - CVE-2024-45738
+    - CVE-2024-45739
+mitre_attack_id:
+    - T1552
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test of JsonWebToken DEBUG Logging Channel
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log
+          source: /opt/splunk/var/log/splunk/splunkd.log
+          sourcetype: splunkd
+          index: _internal
+      test_type: unit
+    - name: True Positive Test of REST_Calls DEBUG Logging Channel
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/splunk/svd-2024-1008.log
+          sourcetype: splunkd
+          source: /opt/splunk/var/log/splunk/splunkd.log
+          index: _internal
+      test_type: unit
+    - name: True Positive Test of AdminManager DEBUG Logging Channel
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/splunk/svd-2024-1009.log
+          sourcetype: splunkd
+          source: /opt/splunk/var/log/splunk/splunkd.log
+          index: _internal
+      test_type: unit

detections/application/splunk_user_enumeration_attempt.yml

@@ -0,0 +1,55 @@
+name: Splunk User Enumeration Attempt
+id: 25625cb4-1c4d-4463-b0f9-7cb462699cde
+version: 9
+creation_date: '2022-04-29'
+modification_date: '2026-05-14'
+author: Lou Stella, Splunk
+status: production
+type: TTP
+description: The following analytic identifies attempts to enumerate usernames in Splunk by detecting multiple failed authentication attempts from the same source. It leverages data from the `_audit` index, specifically focusing on failed authentication events. This activity is significant for a SOC because it can indicate an attacker trying to discover valid usernames, which is a precursor to more targeted attacks like password spraying or brute force attempts. If confirmed malicious, this activity could lead to unauthorized access, compromising the security of the Splunk environment and potentially exposing sensitive data.
+data_source:
+    - Splunk
+search: '`splunkd_failed_auths` | stats count(user) as auths by user, src | where auths>5 | stats values(user) as user, sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames.
+known_false_positives: Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives.
+references:
+    - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html
+drilldown_searches:
+    - name: View the detection results for $user$
+      search: '%original_detection_search% | search  user = $user$'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for $user$
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+finding:
+    title: $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected.
+    entity:
+        field: user
+        type: user
+        score: 40
+threat_objects:
+    - field: src
+      type: ip_address
+analytic_story:
+    - Splunk Vulnerabilities
+asset_type: Endpoint
+cve:
+    - CVE-2021-33845
+mitre_attack_id:
+    - T1078
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: access
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log
+          source: audittrail
+          sourcetype: audittrail
+          index: _audit
+      test_type: unit