Beware of Traitorware: Using Splunk for Persistence

This report demonstrates how the Splunk Universal Forwarder (UF) can be abused as “traitorware” to achieve persistence and remote code execution by configuring a custom app that uses Splunk’s PowerShell input to periodically fetch and execute base64-encoded commands from a controlled web page, running under NT AUTHORITY\System. It provides implementation details, a PoC outcome (e.g., writing whoami output to disk), and practical mitigations (e.g., avoid running UF as admin/root, restrict outbound traffic, monitor UF changes, follow Splunk hardening guidance), emphasizing that this is not a Splunk vulnerability but an abuse of trusted functionality.