Patrick Bareiß

🚨 SAP NetWeaver Webshells Spotted: CVE-2025-31324 in the Wild 🚨 Multiple reports confirmed active exploitation of SAP NetWeaver Visual Composer vulnerabilities (CVE-2025-31324). Attackers are dropping lightweight JSP webshells like the ones shared by Onapsis, captured by ShellSweepX below 👇 — easy to miss, devastating if ignored. 🧹 Enter ShellSweepX — an open-source project from Splunk Threat Research Team built to help defenders proactively hunt, detect, and analyze webshells across their environments. How ShellSweepX helps defenders: 🔹 Wide Coverage Uses 300+ webshell-focused YARA rules across JSP, PHP, ASPX, and others — not just signatures, but entropy, anomaly, and obfuscation detection. 🔹 Lightweight, Flexible, and Scalable ShellSweepX offers agent-based deployment across endpoints with a centralized management server to orchestrate sweeps. It supports webshell file collection, scheduled scans, and makes sweeping hundreds or thousands of systems seamless via API or web UI — all without heavy infrastructure requirements. 🔹 Integrated Threat Hunting Detailed triage output lets you pivot immediately: showing entropy, size, matches, metadata, and AI-assisted file analysis to catch even stealthy or customized webshells. 🔹 Automation-Ready Built with a REST API and frontend dashboard, ShellSweepX enables automatic sweeps, centralized hunting campaigns, and seamless integration into your existing IR playbooks and workflows. Ref: Onapsis: onapsis.com/blog/active-expl… Rapid7: rapid7.com/blog/post/2025/04… 🔥 Full project and how to get started: 👉 ShellSweep: github.com/splunk/ShellSweep 👉 ShellSweepX Blog: splunk.com/en_us/blog/securi…

New Splunk Attack Range got me like : lol github.com/splunk/attack_ran…

🚨 Big News for Splunk Attack Range Users! 🚨 We’ve just dropped a major update— @Snort 3 is now integrated into the Splunk Attack Range! 🎉🐍 Amazing work by @bareiss_patrick ! If you haven’t tried out Attack Range yet, it’s a breeze to get started! 🍃 Clone the repo: github.com/splunk/attack_ran… 📥 Run: python attack_range.py configure to easily select server OSs, enable Snort3 or Zeek, and more! 💻⚙️ And guess what? Some extra goodies like BadBlood, domain-joined systems, and Kali are all waiting. 🎁💣 It’s like making it rain for your test environment! ☔💸 Once you’ve got everything set up, you’ll be diving into a fresh batch of data in Splunk in no time! 📊🔍 Happy hunting, and may the logs be ever in your favor! 🕵️‍♂️🔐

🚨LOLRMM Update 🚂 You thought we were done? Nope. 🔥 Deduplication efforts are in the works 🔥 Experts (@_josehelps) are reviewing the site code to ensure we deliver the most epic LOLRMM experience. 🔥 More and more RMMs are being completed (@Kostastsale @nas_bench ) 🔥 Who wants more Sigma rules? Because, we got them. Autogenerated + easily found on individual RMM pages. Hoping the efforts are final soon and we can get this out the door! Be warned, it's a lot of data and we'll need lots of community ❤️ to make this 100%. Teaser:

🚨 #Splunk Threat Research Team Release 4.18.0!🚨 ✨ Key Updates: 🛡️ Kubernetes Security: Advanced detections for containerized environment threats, including unusual access and abuse scenarios. 🔒 Enhanced MFA Security in PingID: 4 new detections by Steven D., addressing critical aspects of digital authentication security. 🧩 Rhysida Ransomware Analytic Story: In-depth analytics for detecting Rhysida group behaviors and tactics. 🔄 Updated Analytics & Stories: Including NjRAT, RedLine Stealer, and firewall modifications. 🔍 Dive into detailed detections for Kubernetes abuses, multi-factor authentication challenges, and ransomware tactics. Release: github.com/splunk/security_c… Content: Research.Splunk.com

I didn't want to mention it, but after my last SANS preso on hunting drivers, I've decided to build a site similar to LOLBAS project presenting all known vulnerable Windows drivers. More to come. Until then, give it a follow. github.com/LOLDrivers-Projec…

Wanted to share that @Splunk Attack Range has support for the Aurora Agent built in. In the conf, just flip the switch - github.com/splunk/attack_ran… #BlueTeam github.com/splunk/attack_ran…