Splunk Edit User Privilege Escalation

SPLUNK detection rule by Rod Soto, Chase Franklin · Apache-2.0

The following analytic identifies attempts by low-privilege users to escalate their privileges to admin by exploiting the edit_user capability. It detects this activity by analyzing audit trail logs for specific actions such as "change_own_password" and "edit_password" where the info field is "granted" and the user is not an admin or system user. This activity is significant because it indicates potential privilege escalation, which is a critical security concern. If confirmed malicious, this could allow an attacker to gain administrative access, leading to full control over the Splunk environment and potential data breaches.

name: Splunk Edit User Privilege Escalation
id: 39e1c326-67d7-4c0d-8584-8056354f6593
version: 6
creation_date: '2025-05-12'
modification_date: '2026-05-14'
author: Rod Soto, Chase Franklin
status: removed
type: Hunting
data_source:
    - Splunk
description: The following analytic identifies attempts by low-privilege users to escalate their privileges to admin by exploiting the edit_user capability. It detects this activity by analyzing audit trail logs for specific actions such as "change_own_password" and "edit_password" where the info field is "granted" and the user is not an admin or system user. This activity is significant because it indicates potential privilege escalation, which is a critical security concern. If confirmed malicious, this could allow an attacker to gain administrative access, leading to full control over the Splunk environment and potential data breaches.
search: '`audittrail` action IN ("change_own_password","password_change","edit_password") AND info="granted" AND NOT user IN (admin, splunk-system-user) | stats earliest(_time) as event_time values(index) as index values(sourcetype) as sourcetype values(action) as action values(info) as info by user | `splunk_edit_user_privilege_escalation_filter`'
how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover abuse of edit_user privilege.
known_false_positives: This search may produce false positives as password changing actions may be part of normal behavior. Operator will need to investigate these actions in order to discern exploitation attempts.
references:
    - https://advisory.splunk.com/
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Endpoint
    cve:
        - CVE-2023-32707
    mitre_attack_id:
        - T1548
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_edit_user_privilege_escalation.log
            source: audittrail
            sourcetype: audittrail
            custom_index: _audit
deprecation_info:
    reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.
    removed_in_version: 5.6.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b026ebb7-4cb4-4f45-95bb-9ddb03985f04

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion