Researchers Demonstrate Data Exfiltration Using Splunk Universal Forwarder Configurations

Summary

A Huntress researcher demonstrated how custom Splunk Universal Forwarder configurations can route selected files to an attacker-controlled syslog server for exfiltration, and recommended controls to reduce the risk.

Key points

The proof of concept used custom Splunk app configurations to add a log output to an attacker-controlled rsyslog server.
An inputs.conf file directed the Universal Forwarder to monitor a chosen directory and route its contents through the added output, while other logs continued to the usual Splunk server.
The researcher said the configurations could be deployed locally on a compromised endpoint or remotely from a compromised Splunk Deployment Server.
The article states this is abuse of supported Splunk configurations, not a Splunk vulnerability, bug, or new exploit.
Recommended mitigations include network segmentation, restricting outbound traffic, monitoring security-tool logs, protecting agents from tampering, and using Splunk’s reference architecture.

Article Details

Attack Vectors: An attacker with access to a compromised endpoint or deployment server can deploy a Splunk app containing custom inputs.conf and outputs.conf files.
The added configuration can make the Splunk Universal Forwarder monitor a selected local file and send its contents to an attacker-controlled rsyslog server over port 514, while other logs continue to be forwarded normally.
The proof of concept used Splunk's supported configuration behavior and did not use the Universal Forwarder's remote code execution feature.
Defensive Notes: Separate Splunk roles across appliances and apply network segmentation.
Use TLS for inter-Splunk communication, particularly if any Splunk infrastructure is internet-exposed.
Use a randomly generated administrator password or disable the default administrator account.
Restrict Splunk outbound traffic to necessary ports, or disable its internet access.
Avoid installing the Splunk Universal Forwarder on desktop endpoints; where necessary, use compensating controls to prevent agent tampering and ensure users are not administrators.
Monitor internal logs from IT and security tools for suspicious activity, limit outbound traffic to necessary ports and protocols, and use layered network- and host-based detection.
Use Splunk's reference architecture as a baseline for secure deployment.

MITRE ATT&CK

T1048 · Exfiltration Over Alternative ProtocolThe proof of concept exfiltrates monitored file contents from the Splunk Universal Forwarder to a separate rsyslog server using the configured syslog output.

People

Adam RiceHuntress author who describes the Splunk data-exfiltration proof of concept.

Products

SplunkHomeBlogTraitorware and Living Off the Land: Using Splunk to Exfiltrate Data Splunk Universal Forwarderplacing them in the SplunkUniversalForwarder folder or by using a Splunk Deployment Server, the Splunk Universal Forwarder will begin reading and shipping logs based on the inputs.conf and outputs.conf files it finds