Emerging Threathightest

Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Lars B. P. Frydenskov(Trifork Security)Created Mon Nov 27ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff82023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_method_and_response:
        cs-method: POST
        sc-status:
            - 200
            - 302
    selection_uri_upload:
        cs-uri-stem|contains: '/splunkd/__upload/indexing/preview'
        cs-uri-query|contains|all:
            - 'NO_BINARY_CHECK=1'
            - 'input.path=shell.xsl'
    selection_uri_search:
        cs-uri-stem|contains|all:
            - '/api/search/jobs'
            - '/results'
        cs-uri-query|contains|all:
            - '/opt/splunk/var/run/splunk/dispatch/'
            - '/shell.xsl'
    condition: selection_method_and_response and 1 of selection_uri_*