topic Re: Drop Temporary SCCM scripts in Windows Events in Splunk Enterprise

Drop Temporary SCCM scripts in Windows Events

Lynn_01 — Fri, 24 Jul 2026 21:09:12 GMT

On the universal forwarders, I need a regex pattern to drop Powershell temporary script events in splunk. I'm trying to use the "Message" object to filter out the following example:

Script Name = C:\\WINDOWS\\CCM\\SystemTemp\\1b71bac2-99a4-4075-a96e-9ecc803443f5.ps1

So far, my blacklist stanza is:
blacklist1 = EventCode = "4103" Message="C:\\\\WINDOWS\\\\CCM\\\\SystemTemp\\\\.*\.ps1"

But this does not seem to work. Help please!

Re: Drop Temporary SCCM scripts in Windows Events

livehybrid — Sat, 25 Jul 2026 13:17:51 GMT

Hi @Lynn_01

I think you need to adjust the formatting of your blacklist entry in inputs.conf.

Remove the spaces around the inner = characters and the over-escaping of the backslashes.

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
...
...
blacklist1 = EventCode="4103" Message="C:\\WINDOWS\\CCM\\SystemTemp\\.*\.ps1

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful

Marking it as the solution if it resolved your issue

Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

Re: Drop Temporary SCCM scripts in Windows Events

Lynn_01 — Mon, 27 Jul 2026 14:05:20 GMT

Thank you for the response.

Do you think:

blacklist1 = EventCode="4103" Message="C:\\WINDOWS\\CCM\\SystemTemp\\[0-9|a-z]{8}\-([0-9|a-z]{4}\-){3}[0-9|a-z]{12}\.ps1

Would work to only filter out the specific number/word character syntax these temporary scripts use and allow other .ps1 scripts to be ingested?

Re: Drop Temporary SCCM scripts in Windows Events

cartergray70543 — Tue, 28 Jul 2026 08:36:24 GMT

Your regex looks close, but the Message field may not match the exact path format. Before and after the path, and verify the raw event to confirm how Message is stored. Testing the regex against the raw event usually reveals the mismatch.