Splunk is a security tool. In the wrong hands, it's also a persistence mechanism. Huntress details how the Splunk Universal Forwarder can be weaponized by an attacker who already has access.

Before joining Huntress, this analyst spent years as a Splunk admin and noticed something. Here's how Splunk's built-in features can be weaponized for data exfiltration using living-off-the-land techniques.