huntrule

Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Alerts on POST web requests to .xsl endpoints with NO_BINARY_CHECK=1 and input.path, returning 200/302—consistent with a CVE-2023-46214 probe.

FreeReviewedSigma · Medium · v5
Category
webserver
Author
Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT) (SigmaHQ), DRL 1.1
Published
2023-11-27
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags HTTP requests consistent with a potential CVE-2023-46214 exploitation attempt against Splunk Enterprise. It matches POST traffic where the query string includes "NO_BINARY_CHECK=1" and "input.path", and the requested URI ends with ".xsl", indicating a suspicious XML/XSL handling pattern. The detection relies on webserver access log fields for HTTP method, request path/query, and response status (200 or 302).

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange
Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests
Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters
Suspicious SysAidServer Child Processes via Java on Windows
Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe
Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation
Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)
Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host
Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)
Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)
Pivot detection · T1210 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.