Splunk Process Injection Forwarder Bundle Downloads

SPLUNK detection rule by Lou Stella, Splunk · Apache-2.0

The following analytic identifies unauthorized forwarder bundle downloads from Splunk Deployment Servers. It leverages native Splunk logs, specifically the `splunkd` component "PackageDownloadRestHandler," to detect instances where an unauthenticated client may have downloaded forwarder bundles. This activity is significant because it could indicate a potential security breach, allowing unauthorized access to sensitive configurations and applications. If confirmed malicious, an attacker could gain insights into the deployment server's environment, potentially leading to further exploitation or lateral movement within the network.

name: Splunk Process Injection Forwarder Bundle Downloads
id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e
version: 6
creation_date: '2025-05-12'
modification_date: '2026-05-14'
author: Lou Stella, Splunk
status: removed
type: Hunting
description: The following analytic identifies unauthorized forwarder bundle downloads from Splunk Deployment Servers. It leverages native Splunk logs, specifically the `splunkd` component "PackageDownloadRestHandler," to detect instances where an unauthenticated client may have downloaded forwarder bundles. This activity is significant because it could indicate a potential security breach, allowing unauthorized access to sensitive configurations and applications. If confirmed malicious, an attacker could gain insights into the deployment server's environment, potentially leading to further exploitation or lateral movement within the network.
data_source:
    - Splunk
search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`'
how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: None at this time.
references:
    - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html
    - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Endpoint
    cve:
        - CVE-2022-32157
    mitre_attack_id:
        - T1055
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log
            source: /opt/splunk/var/log/splunk/splunkd.log
            sourcetype: splunkd
            custom_index: _internal
deprecation_info:
    reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.
    removed_in_version: 5.6.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a4810ff5-7888-42e4-b4f2-30422c159185

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion