Splunk Digital Certificates Infrastructure Version

SPLUNK detection rule by Lou Stella, Splunk · Apache-2.0

The following analytic identifies improper TLS validation configuration on Splunk search heads and peers post version 9. It leverages REST API calls to retrieve server information and SSL configuration settings, checking fields like `sslVerifyServerCert` and `sslVerifyServerName`. This activity is significant for a SOC as improper TLS settings can expose the infrastructure to man-in-the-middle attacks and data breaches. If confirmed malicious, attackers could intercept or manipulate data, compromising the integrity and confidentiality of communications within the Splunk environment.

name: Splunk Digital Certificates Infrastructure Version
id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7
version: 6
creation_date: '2025-05-12'
modification_date: '2026-05-14'
author: Lou Stella, Splunk
status: removed
type: Hunting
description: The following analytic identifies improper TLS validation configuration on Splunk search heads and peers post version 9. It leverages REST API calls to retrieve server information and SSL configuration settings, checking fields like `sslVerifyServerCert` and `sslVerifyServerName`. This activity is significant for a SOC as improper TLS settings can expose the infrastructure to man-in-the-middle attacks and data breaches. If confirmed malicious, attackers could intercept or manipulate data, compromising the integrity and confidentiality of communications within the Splunk environment.
data_source:
    - Splunk
search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`'
how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: No known at this time.
references:
    - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication
    - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html
    - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Endpoint
    cve:
        - CVE-2022-32153
    mitre_attack_id:
        - T1587.003
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
            source: audittrail
            sourcetype: audittrail
            custom_index: _audit
deprecation_info:
    reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.
    removed_in_version: 5.6.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f24d5726-b838-467d-975b-7685a5652b44

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion