Full Report
This blog illustrates how the Splunk Universal Forwarder (UF) can be used as traitorware for persistence and remote code execution.
Analysis Summary
# Tool/Technique: Traitorware (Splunk Universal Forwarder Abuse)
## Overview
This technique involves the exploitation of the **Splunk Universal Forwarder (UF)**, a trusted log-collection agent, to serve as a Remote Access Trojan (RAT). By abusing legitimate "Technical Add-on" (TA) functionalities—specifically PowerShell script inputs—an attacker can achieve persistence and Remote Code Execution (RCE) without deploying traditional malware files.
## Technical Details
- **Type:** Technique / Traitorware (Abuse of trusted software)
- **Platform:** Windows (via PowerShell), but conceptually applicable to Linux via shell scripts.
- **Capabilities:** Persistence, Remote Code Execution (RCE), Command & Control (C2) through HTML scraping.
- **First Seen:** Publicized technique summary: June 6, 2023.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1543.003 - Create or Modify System Process: Windows Service] (Splunk UF runs as a service)
- [T1053.005 - Scheduled Task/Job: Scheduled Task] (Via Splunk `inputs.conf` cron scheduling)
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- **[TA0011 - Command and Control]**
- [T1102 - Web Service: Bidirectional Communication] (Scraping HTML tags for commands)
## Functionality
### Core Capabilities
- **Scheduled Execution:** Uses the Splunk `inputs.conf` file to define a `[powershell://]` input, utilizing a cron-style schedule to execute scripts at regular intervals.
- **Trusted Execution:** Commands are executed by the Splunk service, which typically runs with high privileges (`NT AUTHORITY\SYSTEM`).
- **Native Integration:** Leverages the `Splunk Add-on for Windows` capabilities, making the malicious activity appear as legitimate log collection or system monitoring.
### Advanced Features
- **Stealthy C2 (HTML Scraping):** The POC script uses `Invoke-WebRequest` to scrape a remote webpage and specifically parse HTML comment tags (`<!-- command -->`) for execution. This avoids direct download of executable files and uses common web traffic.
- **Environment Variable Usage:** Uses `$SplunkHome` to dynamically locate paths, ensuring the malicious app functions regardless of the specific installation drive or directory.
## Indicators of Compromise
- **File Names:**
- `inputs.conf` (located in non-standard subdirectories within `\etc\apps\`)
- Custom PowerShell scripts (e.g., `git.ps1` or similar located in `\etc\apps\<CustomApp>\bin\`)
- **Network Indicators:**
- Outbound connections from the `splunkd.exe` process to unfamiliar external IP addresses or domains (e.g., `10.0.0[.]235` in the POC).
- **Behavioral Indicators:**
- `splunkd.exe` spawning `powershell.exe` with arguments containing `Invoke-WebRequest` or `IEX` (Invoke-Expression).
- Creation of new subdirectories under `C:\Program Files\SplunkUniversalForwarder\etc\apps\`.
## Associated Threat Actors
- This is a general technique applicable to any actor seeking to "Live off the Land" (LotL). While no specific group is named in the article, this method aligns with TTPs used by sophisticated actors to bypass EDR/AV by using "Traitorware."
## Detection Methods
- **Behavioral Detection:** Monitor the process tree for `splunkd.exe` spawning `powershell.exe`. While Splunk legitimately uses PowerShell, unusual script content or high-frequency outbound web requests are anomalies.
- **Configuration Monitoring:** Audit the `\etc\apps\` directory of Splunk installations for new or unauthorized applications and `inputs.conf` modifications.
- **Logging:** Enable PowerShell Script Block Logging (Event ID 4104) to capture the commands being pulled from the remote C2 and executed via `IEX`.
## Mitigation Strategies
- **Least Privilege:** Run the Splunk Universal Forwarder service under a dedicated low-privilege Managed Service Account (MSA) rather than `SYSTEM` where possible.
- **File Integrity Monitoring (FIM):** Monitor the Splunk installation directory, specifically `\etc\apps\`, for unauthorized changes or new file creations.
- **Network Segmentation:** Restrict the UF’s ability to communicate with the open internet. It should only be permitted to communicate with known Splunk Indexers or Deployment Servers.
- **App Whitelisting:** Use a Splunk Deployment Server to enforce a "known good" state of apps and configurations across the fleet.
## Related Tools/Techniques
- **Living off the Land (LotL):** Using legitimate binaries (Lolbins) for malicious intent.
- **Search Head/Indexer Abuse:** Similar techniques can be applied to other Splunk components to exfiltrate data.
- **SolarWinds/Kaseya Style Attacks:** Exploiting management and monitoring software to gain broad environmental access.