How Splunk Universal Forwarder Can Be Abused for Persistence and Remote Code Execution
Summary
A proof of concept shows how a custom Splunk app can make Universal Forwarder periodically fetch and execute PowerShell commands from a web page. The author says this abuses supported functionality, not a Splunk vulnerability.
Key points
- A custom Splunk app can use the Universal Forwarder’s PowerShell input functionality to run a script on a schedule.
- The demonstrated script retrieves commands from HTML comment text on a web page, decodes them, and executes them.
- The commands can be changed remotely by updating the page; the example ran every 10 minutes.
- The author says the technique uses supported Splunk configurations and is not a vulnerability, bug, or new exploit.
- The Universal Forwarder runs as NT Authority\System by default in the demonstrated Windows setup, giving executed scripts that user context.
- Suggested mitigations include monitoring for unexpected installations or behavior, limiting the forwarder’s privileges and outbound traffic, and monitoring security-tool logs and network connections.
Article Details
- Topic
- Using Splunk Universal Forwarder configurations to demonstrate persistence and remote PowerShell command execution
MITRE ATT&CK
People
Vendors
Products
SplunkHomeBlogBeware of Traitorware: Using Splunk for PersistenceSplunk Add-on for WindowsAn example is the Splunk Add-on for Windows, which gives Splunk additional functionality for collecting information from Windows hosts.Splunk Universal ForwarderIn this blog, I will detail how the Splunk Universal Forwarder (UF) can be used as traitorware for persistence and remote code execution.