Splunk Identified SSL TLS Certificates

SPLUNK detection rule by Michael Haag, Splunk · Apache-2.0

The following analytic identifies the usage of Splunk default SSL/TLS certificates within the environment. It leverages tags such as SSL, TLS, and certificate to detect these default certificates by examining the ssl_issuer_common_name field. This activity is significant because using default certificates can expose the environment to potential security risks, as they are not unique and can be easily exploited. If confirmed malicious, attackers could intercept or manipulate data, leading to unauthorized access or data breaches. It is recommended to replace default certificates with valid, unique TLS certificates to enhance security.

name: Splunk Identified SSL TLS Certificates
id: 620fbb89-86fd-4e2e-925f-738374277586
version: 6
creation_date: '2025-05-12'
modification_date: '2026-05-14'
author: Michael Haag, Splunk
status: removed
type: Hunting
description: The following analytic identifies the usage of Splunk default SSL/TLS certificates within the environment. It leverages tags such as SSL, TLS, and certificate to detect these default certificates by examining the ssl_issuer_common_name field. This activity is significant because using default certificates can expose the environment to potential security risks, as they are not unique and can be easily exploited. If confirmed malicious, attackers could intercept or manipulate data, leading to unauthorized access or data breaches. It is recommended to replace default certificates with valid, unique TLS certificates to enhance security.
data_source:
    - Splunk Stream TCP
search: tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`
how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized.
references:
    - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL
    - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Proxy
    cve:
        - CVE-2022-32151
        - CVE-2022-32152
    mitre_attack_id:
        - T1040
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: network
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log
            source: stream:tcp
            sourcetype: stream:tcp
deprecation_info:
    reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.
    removed_in_version: 5.6.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

27f8f155-14ef-43f8-9e91-5a099762f9a0

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion