Troubleshooting Blacklists - Blocking subsets of EventCode 4688

[pscookiemonster]

I'm a bit new to Splunk; apologies if I miss anything obvious.

I'm looking to selectively block events meeting a certain criteria from being indexed.  Here's the current setup:

• Splunk Universal Forwarder 9.1.4.0
• Windows Server 2019

And the conf:

& 'C:\Program Files\SplunkUniversalForwarder\bin\btool.exe' inputs list

...
[WinEventLog://Security]
blacklist1 = REDACTED
blacklist2 = EventCode="4688" Message="New Process Name: (?i)C:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe"
blacklist3 = REDACTED
disabled = 0
evt_dc_name = 
evt_dns_name = 
evt_resolve_ad_obj = 0
host = REDACTED
index = REDACTED
interval = 60
...

Now here's what I see:

• No errors around processing this blacklist (if I use an invalid regex, it grumbles)
• So many splunk process events.  So many.

Not clear on why this blacklist is not working.  Any suggestions?

In Splunk, if I show source for the log, I get this:

06/18/2024 01:49:56 PM LogName=Security EventCode=4688 EventType=0 ComputerName=REDACTED SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=3063451653 Keywords=Audit Success TaskCategory=Process Creation OpCode=Info Message=A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: REDACTED Account Domain: REDACTED Logon ID: 0x3E7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x1e4c New Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x35e4 Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe Process Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.

And finally, if I match that source, to the regex string, it matches, which... should that not mean the event would be blacklisted?  Is there any debug level logs / tooling I should check that might reveal what this is actually doing/not doing?  It seems like it should "just work", but, again, I am quite new with Splunk.

Thanks for any help, and apologies if this is something obvious that I have missed!

[pscookiemonster · Accepted solution]

Resolved!  Two issues:

(1) Don't trust regex you find on the Internet,

(2) Trust but verify

Turns out, I had assumed what I see in "Source" would line up with the data Splunk processed.  It lined up with the regex ("New Process Name:  "has a space after the colon.  In actuality, this is a tab.

I'm using this now.  Could probably use "\t" but playing it safe and allowing one or more whitespace.

blacklist2 = EventCode="4688" Message="New Process Name:\s+C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-(?:powershell|regmon|admon|netmon|MonitorNoHandle).exe"

Above is what I ended up with.  Not perfect, but good enough for a POC, and actually works, at least, in the current environment.

Cheers!