this search may produce false positives as accounts with high privileges may access this file. operator will need to investigate these actions in order to discern exploitation attempts.

t1212
endpoint
splunk

Techniques

T1212

Sample rules

Splunk Low Privilege User Can View Hashed Splunk Password

source: splunk
technicques:
- T1212

Description

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.

Detection logic

`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" 
| stats earliest(_time) as event_time values(method) as method values(status) as status values(clientip) as clientip values(useragent) as useragent values(file) as file by user 
| convert ctime(*time) 
| `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`