Security

Issue with Splunk Universal Forwarder blat.exe?

maurobissante
Explorer

Hello! 

One of our customer has a problem with this executable "C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" that tries to launch this command

"C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" -install mailrelay2.domain.com hostname@domain.com 

Can you help me to understand if this process is generated from Splunk or if it is a custom process?

Thank you,

Mauro

0 Karma

John_Littleton
Explorer

Hi there,

Splunk UF, by default, doesn't create anything or operate outside of $SPLUNK_HOME, in this case C:\Program Files\SplunkUniversalForwarder\

Being this is outside of $SPLUNK_HOME, SplunkUniversalForwarder_script\ is likely a custom folder created by an individual. It looks like the download blat
 zip file contents were extracted into that folder. Not sure if they integrate at all, but they are certainly separate installs and not associated with each other by default.

--
If you found this helpful, give it a thumbs up for good Karma!

0 Karma
Get Updates on the Splunk Community!

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...