Security

Issue with Splunk Universal Forwarder blat.exe?

maurobissante
Explorer

Hello! 

One of our customer has a problem with this executable "C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" that tries to launch this command

"C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" -install mailrelay2.domain.com hostname@domain.com 

Can you help me to understand if this process is generated from Splunk or if it is a custom process?

Thank you,

Mauro

Labels (1)
0 Karma

John_Littleton
Explorer

Hi there,

Splunk UF, by default, doesn't create anything or operate outside of $SPLUNK_HOME, in this case C:\Program Files\SplunkUniversalForwarder\

Being this is outside of $SPLUNK_HOME, SplunkUniversalForwarder_script\ is likely a custom folder created by an individual. It looks like the download blat
 zip file contents were extracted into that folder. Not sure if they integrate at all, but they are certainly separate installs and not associated with each other by default.

--
If you found this helpful, give it a thumbs up for good Karma!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...