Full Report
Your security tools are just as likely to be attacked as anything else. This blog dives into traitorware and how it's used to live off the land.
Analysis Summary
# Tool/Technique: Traitorware (Splunk Abuse)
## Overview
Traitorware refers to a specific sub-category of "Living off the Land" (LotL) attacks where trusted, legitimate security or IT management software is repurposed by an attacker to perform malicious actions. In this context, the technique involves abusing the core logging and configuration features of the **Splunk Universal Forwarder (UF)** to exfiltrate data to an unauthorized third-party server without disrupting the original, legitimate log flow.
## Technical Details
- **Type:** Technique / Living off the Land (LotL)
- **Platform:** Windows, Linux, macOS (Any platform supporting Splunk Universal Forwarder)
- **Capabilities:** Data exfiltration, evasion, dual-homing of logs, remote code execution (via native Splunk features).
- **First Seen:** Reported by Huntress in April 2023 (as a Proof of Concept).
## MITRE ATT&CK Mapping
- **[TA0010 - Exfiltration]**
- **[T1041 - Exfiltration Over C2 Channel]**: Using Splunk's native communication protocols to move data to an attacker-controlled listener.
- **[TA0005 - Defense Evasion]**
- **[T1202 - Indirect Command Execution]**: Using trusted binaries (splunk.exe) to perform actions.
- **[TA0003 - Persistence]**
- **[T1546 - Event Triggered Execution]**: Modifying Splunk configuration bundles ("Apps") to ensure long-term data redirection.
## Functionality
### Core Capabilities
- **Dual-Homing Logs:** By adding a new `outputs.conf` entry in a "local" or "App" directory, an attacker can send a duplicate stream of all ingested logs to a malicious rsyslog server while the primary stream continues to the legitimate Splunk Indexer.
- **Data Redirection:** Leveraging Splunk’s cascading configuration logic to prioritize or add malicious destinations (`tcpout`) without alerting administrators by breaking the main connection.
- **Configuration Manipulation:** Modifying `.conf` files to disable "cooked data" (`sendCookedData=false`), allowing logs to be sent in raw format to non-Splunk listeners like standard Ubuntu rsyslog servers.
### Advanced Features
- **Remote Code Execution (RCE):** Utilizing Splunk's native ability to run scripted inputs (e.g., PowerShell or Shell scripts) to execute arbitrary commands under the context of the Splunk service account (often SYSTEM or root).
- **Stealth Preservation:** By not overwriting the system-level `outputs.conf` and instead using the App-level directory, the malicious configuration is less likely to be flagged by basic file integrity checks on the core installation.
## Indicators of Compromise
- **File Names:**
- `outputs.conf` or `inputs.conf` located in non-standard App directories (e.g., `etc/apps/malicious_bundle/local/`).
- **Network Indicators:**
- Outbound traffic from the Splunk Universal Forwarder process to unknown/external IP addresses on ports typically used for syslog or Splunk (e.g., `514`, `9997`).
- [Example Defanged C2]: `192[.]168[.]0[.]255` (Target of exfiltration).
- **Behavioral Indicators:**
- `splunkd.exe` or `splunk.exe` spawning child processes like `powershell.exe` or `cmd.exe` when not previously configured for scripted inputs.
- Unexpected configuration merging visible in `splunk btool outputs list`.
## Associated Threat Actors
- While this specific POC was developed by researchers, **Living off the Land** techniques are utilized by a wide array of actors, including:
- **APT Groups** (for long-term persistence and evasion).
- **Ransomware operators** (for stealthy data exfiltration prior to encryption).
## Detection Methods
- **Behavioral Detection:** Monitor for network connections originating from Splunk processes to IPs not defined in the corporate Splunk architecture.
- **Configuration Auditing:** Periodically run `splunk btool` to audit the merged configuration and identify "shadow" outputs or unexpected scripted inputs.
- **Process Monitoring:** Baseline the activity of the Splunk Universal Forwarder to alert on unexpected shell execution.
## Mitigation Strategies
- **Principle of Least Privilege:** Run the Splunk Universal Forwarder service as a low-privileged user rather than SYSTEM or root to limit the impact of RCE.
- **Network Egress Filtering:** Restrict the Splunk UF to only communicate with known, authorized Splunk Indexer or Intermediate Forwarder IP addresses.
- **Configuration Hardening:** Use Splunk's "Deployment Server" with strictly controlled server classes to prevent unauthorized "Apps" from being pushed to forwarders.
- **File Integrity Monitoring (FIM):** Monitor the `etc/apps` and `etc/system/local` directories for unauthorized changes to `.conf` files.
## Related Tools/Techniques
- **Rsyslog:** Often used as the receiver for exfiltrated data.
- **Living off the Land Binaries (LoLBins):** General category including PowerShell, Certutil, and WMI.
- **Shadow IT / Tooling Abuse:** Similar to using RMM tools (AnyDesk, ScreenConnect) for unauthorized access.