Traitorware and Living Off the Land: Using Splunk to Exfiltrate Data

This report demonstrates a living‑off‑the‑land abuse of Splunk Universal Forwarder by deploying a custom app whose inputs.conf and outputs.conf redirect selected logs (e.g., a secrets file) to an attacker-controlled syslog server while normal logging continues, enabling covert data exfiltration without exploiting a vulnerability. It explains the role of cascading configurations, highlights detection challenges, and recommends mitigations including role separation, TLS, strong admin hygiene, outbound traffic restrictions, minimizing UF on desktops, and monitoring/segmentation for IT/Sec tools.