Getting Data In

Anonymize clear text credentials in Powershell logs using SEDCMD

geoffmx
Explorer

I am attempting to anonymize clear-text credentials passed via PowerShell referring to the splunk documentation
to Anonymize_data_with_a_sed_script

In the inputs.conf I have...
sourcetype = WinEventLog:Microsoft-Windows-PowerShell/Operational

In props.conf I have...

[WinEventLog:Microsoft-Windows-PowerShell/Operational]
SEDCMD-ps_logs_mask_cred = s/-ScriptBlock*/xxxxxx/g

I have attempted to mask just the password and the credential, but could not get it to work. I am able to do this partially via sed or perl on a linux command line, but have not been able to replicate on splunk.

Sample data

Invoke-Command -computername somePC -ScriptBlock {get-something -password 'som3_verY-Long_Pa$$w0rd'} -Credential somedomain\someuser

Expected output (masking the entire ScriptBlock)

Invoke-Command -computername somePC xxxxxx

Or more appropriately, masking only the password and Credential

Invoke-Command -computername somePC -ScriptBlock {get-something -password 'xxxxxx'} -Credential xxxxxx

Any help will be much appreciated!

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi geoffmx,
with SEDCMD you replace the regex you have in the first part with the one in the second part, so try something like this in props.conf:

SEDCMD-ps_logs_mask_cred = s/-ScriptBlock\s.*/xxxxxx/g

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi geoffmx,
with SEDCMD you replace the regex you have in the first part with the one in the second part, so try something like this in props.conf:

SEDCMD-ps_logs_mask_cred = s/-ScriptBlock\s.*/xxxxxx/g

Bye.
Giuseppe

0 Karma

geoffmx
Explorer

Thanks gcusello! This helps with masking everything after -ScriptBlock. I am also attempting to mask the text just after -password and -Credential.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi geoffmx,
you have work in the same way:

SEDCMD-ps_logs_mask_cred = s/-password\s+.*\s+-Credential\s+.*/-password\sxxxxxx-Credential\sxxxxxx/g

Bye.
Giuseppe

0 Karma

geoffmx
Explorer

Thanks again!

I finally got it to work with this.

SEDCMD-ps_logs_mask_cred = s/-password\s[[:alnum:][:punct:]]*/-password xxxxx/g s/-Credential\s[[:alnum:][:punct:]]*/-Credential xxxxx/g

I like your method too. Thanks again for pointing me in the right direction.

0 Karma

dstaulcu
Builder

Gotta love positional based strategies for masking passwords. We have something like 200 masking rules which process against every event for sourcetypes where passwords are probable. Next strat is user education. Hopefully Stream processor will give more logic control for sensitive data masking.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...