Splunk Enterprise KV Store Incorrect Authorization

name: Splunk Enterprise KV Store Incorrect Authorization
id: 8f0e8380-a835-4f2b-b749-9ce119364df0
version: 9
creation_date: '2024-01-22'
modification_date: '2026-06-24'
author: Rod Soto, Eric McGinnis, Chase Franklin
status: deprecated
type: Hunting
description: The following analytic detects unauthorized attempts to reload Splunk KV Store collections via the REST API. It leverages internal index logs to identify POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload` endpoint, focusing on status codes starting with '2'. This activity is significant as it may indicate improper permission handling, potentially leading to unauthorized deletion of KV Store collections. If confirmed malicious, this could result in data loss or unauthorized data manipulation, impacting the integrity and availability of critical Splunk data.
data_source:
    - Splunk
search: '`splunkda` uri=/servicesNS/nobody/search/admin/collections-conf/_reload status=2* method="POST" user=* file=_reload | stats count min(_time) as firstTime max(_time) as lastTime values(status) as status by host clientip file method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_kv_store_incorrect_authorization_filter`'
how_to_implement: Requires access to internal indexes and REST API enabled instances.
known_false_positives: This is a hunting search and will produce false positives. Operator must follow results into instances where curl requests coming from actual users may indicate intent of exploitation.
references:
    - https://advisory.splunk.com/advisories/SVD-2024-0105
analytic_story:
    - Splunk Vulnerabilities
asset_type: Splunk Server
cve:
    - CVE-2024-23675
mitre_attack_id:
    - T1548
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: application
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_enterprise_kv_store_incorrect_authorization_splunkd_access.log
          source: /opt/splunk/var/log/splunk/splunkd_access.log
          sourcetype: splunkd_access
          index: _internal
      test_type: unit
deprecation_info:
    reason: Detection has been deprecated. The affected Splunk software versions (below 9.0.8 and 9.1.3)are no longer supported, having reached End of Life (EOL), and the logic is not accurately detecting the malicious activity.
    removed_in_version: 6.4.0
    replacement_content: []