Splunk SG Information Disclosure for Low Privs User (SVD-2024-1005) Detection Rule

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Splunk SG Information Disclosure for Low Privs User - Description: In Splunk Enterprise versions below 9.3.0, 9.2.1, and 9.1.6, and in Splunk Secure Gateway versions for Splunk Cloud Platform below 3.4.259, 3.6.17, and 3.7.0, low-privilege users (not holding the "admin" or "power" Splunk roles) can view App Key Value Store (KV Store) deployment configurations and public/private keys. 2. Search: - SPL Query: 3. Data Source: - Source Name: Splunk - Platform: Splunk - Source Type: - Source: - Supported Apps: N/A 4. Macro Usage: - Macro Names: and - Macro Description: is a default-empty macro that allows users to filter out any results (false positives) without editing the SPL. 5. Annotations: - MITRE ATT&CK: T1087 - Technique: Account Discovery - Tactic: Discovery - Threat Actor: FIN13 6. Default Configuration: - Disabled: true - Cron Schedule: 0 - Earliest Time: -70m@m - Latest Time: -10m@m - Schedule Window: auto - Create Risk Event: false 7. Implementation: - Requires access to internal index 8. Known False Positives: - This is a hunting search and will generate false positives. The focus of the search should be on unusual requests originating from non-administrator users. 9. Associated Analytics Story: - Splunk Vulnerabilities 10. Risk-Based Analytics (RBA): - Risk Message: User potentially exposing Splunk Security Gateway sensitive information - Risk Score: 40 - Impact: 80 - Confidence: 50 11. References: - https://advisory.splunk.com/advisories/SVD-2024-1005 12. Detection Testing: - Test Type: Validation, Unit, Integration - Status: Passed - Dataset: N/A - Source: N/A - Source Type: N/A 13. Source: GitHub This information provides a detailed description of the vulnerability, detection methods, data sources, macro usage, annotations, default configuration, implementation, known false positives, associated analytics story, risk-based analytics, references, and detection testing results.

Goal Reached Thanks to every supporter — we hit 100%!

Splunk SG Information Disclosure for Low Privs User (SVD-2024-1005) Detection Rule