Splunk protocol impersonation weak encryption selfsigned

SPLUNK detection rule by Rod Soto, Splunk · Apache-2.0

The following analytic identifies the use of Splunk's default self-signed certificates, which are flagged as insecure. It detects events from the `splunkd` log where the event message indicates that an X509 certificate should not be used. This activity is significant because using weak encryption and self-signed certificates can expose the system to man-in-the-middle attacks and other security vulnerabilities. If confirmed malicious, attackers could impersonate Splunk services, intercept sensitive data, and compromise the integrity of the Splunk environment.

name: Splunk protocol impersonation weak encryption selfsigned
id: c76c7a2e-df49-414a-bb36-dce2683770de
version: 6
creation_date: '2025-05-12'
modification_date: '2026-05-14'
author: Rod Soto, Splunk
status: removed
type: Hunting
description: The following analytic identifies the use of Splunk's default self-signed certificates, which are flagged as insecure. It detects events from the `splunkd` log where the event message indicates that an X509 certificate should not be used. This activity is significant because using weak encryption and self-signed certificates can expose the system to man-in-the-middle attacks and other security vulnerabilities. If confirmed malicious, attackers could impersonate Splunk services, intercept sensitive data, and compromise the integrity of the Splunk environment.
data_source:
    - Splunk
search: '`splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`'
how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward.
references:
    - https://www.splunk.com/en_us/product-security
    - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation
    - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Endpoint
    cve:
        - CVE-2022-32152
    mitre_attack_id:
        - T1588.004
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.log
            source: /opt/splun/var/log/splunk/splunkd.log
            sourcetype: splunkd
            custom_index: _internal
deprecation_info:
    reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.
    removed_in_version: 5.6.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

36d043b5-268d-44b7-8929-1e9eb16e43c8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion