Issue with Splunk Universal Forwarder blat.exe?

maurobissante — Thu, 16 Mar 2023 18:21:14 GMT

Hello!

One of our customer has a problem with this executable "C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" that tries to launch this command

"C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" -install mailrelay2.domain.com hostname@domain.com

Can you help me to understand if this process is generated from Splunk or if it is a custom process?

Thank you,

Mauro

Re: Splunk Universal Forwarder blat.exe

John_Littleton — Thu, 16 Mar 2023 00:09:21 GMT

Hi there,

Splunk UF, by default, doesn't create anything or operate outside of $SPLUNK_HOME, in this case C:\Program Files\SplunkUniversalForwarder\

Being this is outside of $SPLUNK_HOME, SplunkUniversalForwarder_script\ is likely a custom folder created by an individual. It looks like the download blat zip file contents were extracted into that folder. Not sure if they integrate at all, but they are certainly separate installs and not associated with each other by default.

--
If you found this helpful, give it a thumbs up for good Karma!

topic Issue with Splunk Universal Forwarder blat.exe? in Security

Issue with Splunk Universal Forwarder blat.exe?

Re: Splunk Universal Forwarder blat.exe