On the universal forwarders, I need a regex pattern to drop Powershell temporary script events in splunk. I'm trying to use the "Message" object to filter out the following example:
Script Name = C:\\WINDOWS\\CCM\\SystemTemp\\1b71bac2-99a4-4075-a96e-9ecc803443f5.ps1
So far, my blacklist stanza is:
blacklist1 = EventCode = "4103" Message="C:\\\\WINDOWS\\\\CCM\\\\SystemTemp\\\\.*\.ps1"
But this does not seem to work. Help please!
