Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests
Flags Splunk web exploitation patterns for CVE-2023-46214 using shell.xsl uploads followed by search-result URIs.
- Category
- webserver
- Author
- Lars B. P. Frydenskov(Trifork Security) (SigmaHQ), DRL 1.1
- Published
- 2023-11-27
- Updated
- 2026-07-31
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies HTTP POST requests that return success or redirect status while targeting Splunk Enterprise endpoints associated with file upload and subsequent search job result retrieval. It looks for specific URI patterns that include insecure XML parsing parameters (e.g., NO_BINARY_CHECK=1 and shell.xsl) and references to the dispatch directory and result paths used by the public proof-of-concept exploit workflow. The detection relies on webserver telemetry capturing request method, response code, and full request URI and query strings.
Reporting behind it
- github.comhttps://github.com/nathan31337/Splunk-RCE-poc/
- blog.hrncirik.nethttps://blog.hrncirik.net/cve-2023-46214-analysis
- advisory.splunk.comhttps://advisory.splunk.com/advisories/SVD-2023-1104
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise_poc.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests
id: ad87a17e-0d92-4557-bc23-84c7ae889156
related:
- id: 04017cd5-621e-4ec4-a762-1f042fe3d3e5
type: derived
- id: ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
type: derived
status: test
description: This rule identifies HTTP POST requests that return success or redirect status while targeting Splunk Enterprise endpoints associated with file upload and subsequent search job result retrieval. It looks for specific URI patterns that include insecure XML parsing parameters (e.g., NO_BINARY_CHECK=1 and shell.xsl) and references to the dispatch directory and result paths used by the public proof-of-concept exploit workflow. The detection relies on webserver telemetry capturing request method, response code, and full request URI and query strings.
references:
- https://github.com/nathan31337/Splunk-RCE-poc/
- https://blog.hrncirik.net/cve-2023-46214-analysis
- https://advisory.splunk.com/advisories/SVD-2023-1104
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise_poc.yml
author: Lars B. P. Frydenskov(Trifork Security), Huntrule Team
date: 2023-11-27
tags:
- attack.lateral-movement
- attack.t1210
- cve.2023-46214
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_method_and_response:
cs-method: POST
sc-status:
- 200
- 302
selection_uri_upload:
cs-uri-stem|contains: /splunkd/__upload/indexing/preview
cs-uri-query|contains|all:
- NO_BINARY_CHECK=1
- input.path=shell.xsl
selection_uri_search:
cs-uri-stem|contains|all:
- /api/search/jobs
- /results
cs-uri-query|contains|all:
- /opt/splunk/var/run/splunk/dispatch/
- /shell.xsl
condition: selection_method_and_response and 1 of selection_uri_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1