Splunk DoS via Malformed S2S Request

SPLUNK detection rule by Lou Stella, Splunk · Apache-2.0

The following analytic identifies attempts to exploit a Denial of Service (DoS) vulnerability in the Splunk-to-Splunk (S2S) protocol by detecting malformed S2S requests. It leverages `splunkd` logs, specifically looking for "ERROR" level logs from the "TcpInputProc" component with the thread name "FwdDataReceiverThread" and the message "Invalid _meta atom." This activity is significant as it targets a known vulnerability that could disrupt Splunk services. If confirmed malicious, this could lead to service outages, impacting the availability and reliability of Splunk for monitoring and analysis.

name: Splunk DoS via Malformed S2S Request
id: fc246e56-953b-40c1-8634-868f9e474cbd
version: 7
creation_date: '2022-03-24'
modification_date: '2026-05-14'
author: Lou Stella, Splunk
status: removed
type: TTP
description: The following analytic identifies attempts to exploit a Denial of Service (DoS) vulnerability in the Splunk-to-Splunk (S2S) protocol by detecting malformed S2S requests. It leverages `splunkd` logs, specifically looking for "ERROR" level logs from the "TcpInputProc" component with the thread name "FwdDataReceiverThread" and the message "Invalid _meta atom." This activity is significant as it targets a known vulnerability that could disrupt Splunk services. If confirmed malicious, this could lead to service outages, impacting the availability and reliability of Splunk for monitoring and analysis.
data_source:
    - Splunk
search: '`splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`'
how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422.
known_false_positives: None.
references:
    - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
drilldown_searches:
    - name: View the detection results for $host$
      search: '%original_detection_search% | search  host = $host$'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for $host$
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$
    risk_objects:
        - field: host
          type: system
          score: 50
    threat_objects:
        - field: src
          type: ip_address
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Endpoint
    cve:
        - CVE-2021-3422
    mitre_attack_id:
        - T1498
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
            source: /opt/splunk/var/log/splunk/splunkd.log
            sourcetype: splunkd
            custom_index: _internal
deprecation_info:
    reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.
    removed_in_version: 5.6.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

187a4a78-864e-4351-a9b4-7fab0b31929d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion