Loading story…
Splunk documented and later removed a detection for privilege escalation in which low-privilege users could abuse the edit_user capability to obtain administrative access. The analytic monitored _audit logs for password-related actions including change_own_password, password_change, and edit_password when access was granted to accounts that were not administrators or system users, and warned that successful exploitation could result in full control of the Splunk environment and potential data exposure.
The detection was mapped to MITRE ATT&CK technique T1548: Abuse Elevation Control Mechanism, which covers privilege escalation and defense evasion through misuse of built-in control mechanisms across platforms. Splunk marked the analytic as deprecated and removed it after the underlying issue, tracked as CVE-2023-32707, was patched in current releases, noting the detection had been disabled by default, required access to the _audit index, and could produce false positives during legitimate password changes.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the "Splunk Edit User Privilege Escalation" detection from its content library in version 5.6.0 because the associated vulnerabilities had been patched in the latest Splunk release. The detection was designed to identify low-privilege users abusing the edit_user capability and was associated with CVE-2023-32707.
The MITRE ATT&CK technique entry for T1548, Abuse Elevation Control Mechanism, was last modified. The entry covers sub-techniques T1548.001 through T1548.006 and maps them to Privilege Escalation and Defense Evasion across multiple platforms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk removed a hunting analytic after the underlying vulnerabilities were patched in current releases, but the detection documented how low-privilege users could attempt to access hashed Splunk passwords through the `conf-user-seed` REST endpoint. The analytic monitored `splunkd_web` access logs for requests to that endpoint because such activity could expose credential material and support privilege escalation to full administrative control of a Splunk instance. The activity was mapped to MITRE ATT&CK technique `T1212` (**Exploitation for Credential Access**), which covers abuse of software flaws to obtain credentials or bypass authentication controls. MITRE notes that this class of exploitation can enable forged authentication artifacts, replayed authentication traffic, unintended token creation or renewal in cloud environments, and broader privilege escalation when credentialing systems are affected.
Aug 12, 2026
Splunk has published a new analytic to detect exploitation of the Linux kernel local privilege escalation flaw known as **Dirty Frag**, tied to `CVE-2026-43284` and `CVE-2026-43500`. The detection maps to MITRE ATT&CK technique `T1548.001` for abuse of setuid and setgid mechanisms, and is designed to identify attackers escalating privileges from an unprivileged Linux process to root. The analytic looks for a distinctive exploit chain in Linux `auditd` telemetry: a burst of `splice()` or `vmsplice()` syscalls from a process launched from a user-writable path, followed within five minutes by execution of a **setuid** binary in the same audit session. Splunk said the detection is intended for Splunk Enterprise Security, is disabled by default, and requires Linux `auditd` data with audit rule keys for `splice_user` and `process_creation`; it also warned that high-I/O legitimate workloads may need tuning or allowlisting because the threshold was calibrated against the public V4bel proof of concept.
Jul 16, 2026
Splunk has removed several security analytics from its Threat Research content library after the underlying vulnerabilities were patched in current releases, including detections tied to path traversal, SPL injection, CSRF, unauthorized admin account creation, and Analytics Workspace data exfiltration. The retired content covered **CVE-2022-26889**, **CVE-2022-43566**, **CVE-2023-22942**, and **CVE-2023-22933**, with detections aimed at spotting exploitation attempts in on-premises deployments through internal access logs, audit searches, and REST API queries. The withdrawn detections had been designed to identify attacks such as crafted `../` traversal requests, abuse of the Splunk Secure Gateway `kvstore_client` endpoint, suspicious `sid` query activity in Analytics Workspace, and the presence of nonstandard administrative accounts that could indicate persistence or privilege escalation. Splunk said some analytics were deprecated because they were patched and no longer maintained, while at least one lookup file editing path traversal detection was removed because it did not accurately detect malicious activity and was ineffective against obfuscated requests; several notices also warned of false positives, disabled-by-default status, and limited usefulness without manual investigation.
Aug 12, 2026