Potential CVE-2023-46214 Exploitation Attempt

title: Potential CVE-2023-46214 Exploitation Attempt
id: 04017cd5-621e-4ec4-a762-1f042fe3d3e5
related:
    - id: ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
      type: derived
status: test
description: |
    Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing
references:
    - https://github.com/nathan31337/Splunk-RCE-poc/
    - https://blog.hrncirik.net/cve-2023-46214-analysis
    - https://advisory.splunk.com/advisories/SVD-2023-1104
author: Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)
date: 2023-11-27
tags:
    - attack.lateral-movement
    - attack.t1210
    - cve.2023-46214
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains|all:
            - 'NO_BINARY_CHECK=1'
            - 'input.path'
        cs-uri-query|endswith: '.xsl'
        sc-status:
            - 200
            - 302
    condition: selection
falsepositives:
    - Unknown
level: medium