Detection: Splunk Command and Scripting Interpreter Risky SPL MLTK

Description

The following analytic identifies the execution of risky SPL commands with abnormally long run times by leveraging a machine learning model named "risky_command_abuse." It uses the Splunk Audit data model to compare current search activities against a baseline of the past seven days. This activity is significant for a SOC as it can indicate potential misuse or abuse of powerful SPL commands, which could lead to unauthorized data access or system manipulation. If confirmed malicious, this activity could allow an attacker to execute arbitrary scripts, delete data, or exfiltrate sensitive information.

Search

 1
 2| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*
 3| runshellscript *", "*
 4| collect *","*
 5| delete *", "*
 6| fit *", "*
 7| outputcsv *", "*
 8| outputlookup *", "*
 9| run *", "*
10| script *", "*
11| sendalert *", "*
12| sendemail *", "*
13| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h 
14| apply risky_command_abuse 
15| fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) 
16| rename IsOutlier(run_time) as isOutlier, _time as timestamp 
17| where isOutlier>0.5 
18| `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
Splunk	Splunk	'splunkd_ui_access'	'splunkd_ui_access.log'	N/A

Macros Used

| splunk_command_and_scripting_interpreter_risky_spl_mltk_filter | search * |

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands.

Known False Positives

If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky.

Associated Analytic Story

• Splunk Vulnerabilities

Risk Based Analytics (RBA)

References

• https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 2