Product
Splunk Universal Forwarder
- First Reported
- Apr 11, 2023
- Latest Reported
- Jun 6, 2023
Reported Context (2)
- In this blog, I will detail how the Splunk Universal Forwarder (UF) can be used as traitorware for persistence and remote code execution. How Splunk Universal Forwarder Can Be Abused for Persistence and Remote Code Execution
- placing them in the SplunkUniversalForwarder folder or by using a Splunk Deployment Server, the Splunk Universal Forwarder will begin reading and shipping logs based on the inputs.conf and outputs.conf files it finds Researchers Demonstrate Data Exfiltration Using Splunk Universal Forwarder Configurations
People (2)
MITRE ATT&CK (2)
Vendors (1)
Products (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.