SOC239 — Remote Code Execution Detected in Splunk Enterprise

SOC239 — Remote Code Execution Detected in Splunk Enterprise

Event ID: 201
Platform: LetsDefend

Alert

Based on the information provided in this alert, on the host Splunk Enterprise with IP 172[.]16[.]20[.]13, remote code was injected from 180[.]101[.]88[.]240. The malicious actor injected remote code using an XSLT payload.

Definition:
Extensible Stylesheet Language Transformations (XSLT) is an XML-based language used, in conjunction with specialized processing software, for the transformation of XML documents.

No action was taken on this alert …

blue team cybersecurity incident response letsdefendio rce-vulnerability