splunk_escuHunting

Splunk Path Traversal In Splunk App For Lookup File Edit

The following analytic identifies path traversal attempts in the Splunk App for Lookup File Editing. It detects specially crafted web requests targeting lookup files by analyzing the `uri_query` field in the `_internal` index. This activity is significant because it allows low-privilege users to read and write to restricted areas of the Splunk installation directory, potentially accessing sensitive files like password hashes. If confirmed malicious, this could lead to unauthorized access, data breaches, and further exploitation of the Splunk environment.

Detection Query

`splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file owner namespace  version | stats count by clientip namespace lookup_file uri_query | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`

Author

Rod Soto, Eric McGinnis

Data Sources

Splunk

References

https://advisory.splunk.com/

Raw Content

name: Splunk Path Traversal In Splunk App For Lookup File Edit
id: 8ed58987-738d-4917-9e44-b8ef6ab948a6
version: 9
creation_date: '2023-06-01'
modification_date: '2026-06-24'
author: Rod Soto, Eric McGinnis
status: deprecated
type: Hunting
description: The following analytic identifies path traversal attempts in the Splunk App for Lookup File Editing. It detects specially crafted web requests targeting lookup files by analyzing the `uri_query` field in the `_internal` index. This activity is significant because it allows low-privilege users to read and write to restricted areas of the Splunk installation directory, potentially accessing sensitive files like password hashes. If confirmed malicious, this could lead to unauthorized access, data breaches, and further exploitation of the Splunk environment.
data_source:
    - Splunk
search: '`splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file owner namespace  version | stats count by clientip namespace lookup_file uri_query | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`'
how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
known_false_positives: This search may find additional path traversal exploitation attempts or malformed requests.
references:
    - https://advisory.splunk.com/
analytic_story:
    - Splunk Vulnerabilities
asset_type: Endpoint
mitre_attack_id:
    - T1083
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: application
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.log
          source: splunkd_access
          sourcetype: splunkd_access
          index: _internal
      test_type: unit
deprecation_info:
    reason: Detection has been deprecated. The logic is not accurately detecting the malicious activity.
    removed_in_version: 6.4.0
    replacement_content: []