Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Alerts on POST web requests to .xsl endpoints with NO_BINARY_CHECK=1 and input.path, returning 200/302—consistent with a CVE-2023-46214 probe.

FreeReviewedSigma · Medium · v5

Category: webserver
Author: Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT) (SigmaHQ), DRL 1.1
Published: 2023-11-27
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule flags HTTP requests consistent with a potential CVE-2023-46214 exploitation attempt against Splunk Enterprise. It matches POST traffic where the query string includes "NO_BINARY_CHECK=1" and "input.path", and the requested URI ends with ".xsl", indicating a suspicious XML/XSL handling pattern. The detection relies on webserver access log fields for HTTP method, request path/query, and response status (200 or 302).

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange

Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com

Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Suspicious SysAidServer Child Processes via Java on Windows

Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Pivot detection · T1210 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

possible-cve-2023-46214-rce-probe-against-splunk-enterprise-via-xsl-post-request-04017cd5

title: Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)
id: 62bd0e1a-0abd-4ca1-acca-30efb2c7dc99
related:
  - id: ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
    type: derived
  - id: 04017cd5-621e-4ec4-a762-1f042fe3d3e5
    type: derived
status: test
description: This rule flags HTTP requests consistent with a potential CVE-2023-46214 exploitation attempt against Splunk Enterprise. It matches POST traffic where the query string includes "NO_BINARY_CHECK=1" and "input.path", and the requested URI ends with ".xsl", indicating a suspicious XML/XSL handling pattern. The detection relies on webserver access log fields for HTTP method, request path/query, and response status (200 or 302).
references:
  - https://github.com/nathan31337/Splunk-RCE-poc/
  - https://blog.hrncirik.net/cve-2023-46214-analysis
  - https://advisory.splunk.com/advisories/SVD-2023-1104
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise.yml
author: Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT), Huntrule Team
date: 2023-11-27
tags:
  - attack.lateral-movement
  - attack.t1210
  - cve.2023-46214
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains|all:
      - NO_BINARY_CHECK=1
      - input.path
    cs-uri-query|endswith: .xsl
    sc-status:
      - 200
      - 302
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL