Emerging Threatmediumtest

Potential CVE-2023-46214 Exploitation Attempt

Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)Created Mon Nov 2704017cd5-621e-4ec4-a762-1f042fe3d3e52023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection:
        cs-method: POST
        cs-uri-query|contains|all:
            - 'NO_BINARY_CHECK=1'
            - 'input.path'
        cs-uri-query|endswith: '.xsl'
        sc-status:
            - 200
            - 302
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0008 · Lateral Movement

Techniques

T1210 · Exploitation of Remote Services

Other

cve.2023-46214detection.emerging-threats

Related Rules

DerivedEmerging Threathigh

Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

04017cd5-621e-4ec4-a762-1f042fe3d3e5

Status

test

Level

medium

Type

Emerging Threat

Created

Mon Nov 27

Author

Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)

Path

rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise.yml

Raw Tags

attack.lateral-movementattack.t1210cve.2023-46214detection.emerging-threats

View on GitHub