topic Re: Anonymize clear text credentials in Powershell logs using SEDCMD in Getting Data In

Anonymize clear text credentials in Powershell logs using SEDCMD

geoffmx — Wed, 30 Sep 2020 01:28:58 GMT

I am attempting to anonymize clear-text credentials passed via PowerShell referring to the splunk documentation
to Anonymize_data_with_a_sed_script

In the inputs.conf I have...
sourcetype = WinEventLog:Microsoft-Windows-PowerShell/Operational

In props.conf I have...

[WinEventLog:Microsoft-Windows-PowerShell/Operational]
SEDCMD-ps_logs_mask_cred = s/-ScriptBlock*/xxxxxx/g

I have attempted to mask just the password and the credential, but could not get it to work. I am able to do this partially via sed or perl on a linux command line, but have not been able to replicate on splunk.

Sample data

Invoke-Command -computername somePC -ScriptBlock {get-something -password 'som3_verY-Long_Pa$$w0rd'} -Credential somedomain\someuser

Expected output (masking the entire ScriptBlock)

Invoke-Command -computername somePC xxxxxx

Or more appropriately, masking only the password and Credential

Invoke-Command -computername somePC -ScriptBlock {get-something -password 'xxxxxx'} -Credential xxxxxx

Any help will be much appreciated!

Re: Anonymize clear text credentials in Powershell logs using SEDCMD

gcusello — Wed, 31 Jul 2019 09:32:12 GMT

Hi geoffmx,
with SEDCMD you replace the regex you have in the first part with the one in the second part, so try something like this in props.conf:

SEDCMD-ps_logs_mask_cred = s/-ScriptBlock\s.*/xxxxxx/g

Bye.
Giuseppe

Re: Anonymize clear text credentials in Powershell logs using SEDCMD

geoffmx — Wed, 31 Jul 2019 10:21:04 GMT

Thanks gcusello! This helps with masking everything after -ScriptBlock. I am also attempting to mask the text just after -password and -Credential.

Re: Anonymize clear text credentials in Powershell logs using SEDCMD

gcusello — Wed, 31 Jul 2019 11:00:42 GMT

Hi geoffmx,
you have work in the same way:

SEDCMD-ps_logs_mask_cred = s/-password\s+.*\s+-Credential\s+.*/-password\sxxxxxx-Credential\sxxxxxx/g

Bye.
Giuseppe

Re: Anonymize clear text credentials in Powershell logs using SEDCMD

geoffmx — Wed, 31 Jul 2019 11:12:53 GMT

Thanks again!

I finally got it to work with this.

SEDCMD-ps_logs_mask_cred = s/-password\s[[:alnum:][:punct:]]*/-password xxxxx/g s/-Credential\s[[:alnum:][:punct:]]*/-Credential xxxxx/g

I like your method too. Thanks again for pointing me in the right direction.

Re: Anonymize clear text credentials in Powershell logs using SEDCMD

dstaulcu — Fri, 02 Aug 2019 02:01:49 GMT

Gotta love positional based strategies for masking passwords. We have something like 200 masking rules which process against every event for sourcetypes where passwords are probable. Next strat is user education. Hopefully Stream processor will give more logic control for sensitive data masking.