Techniques
Sample rules
Splunk RCE via User XSLT
- source: splunk
- technicques:
Description
The following analytic identifies potential remote code execution (RCE) attempts via user-supplied Extensible Stylesheet Language Transformations (XSLT) in Splunk versions 9.1.x. It detects this activity by analyzing splunkd_ui logs for specific URI patterns and status codes indicative of XSLT injection attempts. This activity is significant because successful exploitation could allow an attacker to execute arbitrary code on the Splunk server. If confirmed malicious, this could lead to full system compromise, unauthorized data access, and further lateral movement within the network.
Detection logic
`splunkd_ui` ((uri="*NO_BINARY_CHECK=1*" AND "*input.path=*.xsl*") OR uri="*dispatch*.xsl*") AND uri!= "*splunkd_ui*"
| rex field=uri "(?<string>=\s*([\S\s]+))"
| eval decoded_field=urldecode(string)
| eval action=case(match(status,"200"),"Allowed",match(status,"303
|500
|401
|403
|404
|301
|406"),"Blocked",1=1,"Unknown")
| stats count min(_time) as firstTime max(_time) as lastTime by clientip useragent uri decoded_field action host
| rename clientip as src, uri as dest_uri
| iplocation src
| fillnull value="N/A"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table firstTime, lastTime src, useragent, action, count, Country, Region, City, dest_uri, decoded_field
| `splunk_rce_via_user_xslt_filter`