All --- thank you for your insight thus far. Unfortunately, the issue still persists despite trying a number of different approaches. The current blacklists (included in the screenshot below) are successful in that they are able to filter out events (such as those shown in the sample log --- also shown below).
Note: I do not have the Windows TA installed on the endpoint on which this blacklist is published (only upstream on my HA and Splunk Cloud hosted environment).
inputs.conf
[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled = 0
index = windows
evt_resolve_ad_obj = 1
checkpointInterval = 5
renderXml = false
whitelist = 4103,4104
blacklist1 = EventCode="4103" "+*SplunkUniversalForwarder\\bin\\splunk-powershell*+"
blacklist2 = EventCode="4104" "+*SplunkUniversalForwarder\\bin\\splunk-powershell*+"
Log
01/26/2023 09:57:53 AM
LogName=Microsoft-Windows-PowerShell/Operational
EventCode=4104
EventType=5
ComputerName=COMPUTER.acme.corp
User=SYSTEM
Sid=S-1-5-18
SidType=1
SourceName=Microsoft-Windows-PowerShell
Type=Verbose
RecordNumber=10689125
Keywords=None
TaskCategory=Execute a Remote Command
OpCode=On create calls
Message=Creating Scriptblock text (1 of 1):
{
[void]$batch.Add($_)
if ($batch.Count -ge $batchSize) {
$batchAndStanza = [System.Tuple]::Create($batch.ToArray(), $stanza)
[void]$serializingQueue.Add($batchAndStanza)
[void]$batch.Clear()
}
}
ScriptBlock ID: b3e9c4de-ea6b-445a-a3af-31131f9337a7
Path: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell-common.ps1
Where this strategy falls apart is with the log example below where the field containing this data contains other data as well (not just the file path in question). Is there an approach here with regards to RegEx and blacklisting that will work? If so, can you provide such?
01/26/2023 11:06:05 AM
LogName=Microsoft-Windows-PowerShell/Operational
EventCode=4103
EventType=4
ComputerName=COMPUTER.acme.corp
User=SYSTEM
Sid=S-1-5-18
SidType=1
SourceName=Microsoft-Windows-PowerShell
Type=Information
RecordNumber=10710308
Keywords=None
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
Message=CommandInvocation(Start-Sleep): "Start-Sleep"
ParameterBinding(Start-Sleep): name="Milliseconds"; value="200"
Context:
Severity = Informational
Host Name = ConsoleHost
Host Version = 5.1.19041.2364
Host ID = 669eaf0a-e3f8-4a4a-ba5c-07aaa7cbf8bf
Host Application = powershell.exe -command & {get-content C:\WINDOWS\TEMP\\input20898122fee20402.tmp | C:\Program` Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1 C:\Program` Files\SplunkUniversalForwarder 20898122fee20402}
Engine Version = 5.1.19041.2364
Runspace ID = 5291985e-c02c-4052-9465-91ab0c5a7989
Pipeline ID = 1
Command Name = Start-Sleep
Command Type = Cmdlet
Script Name =
Command Path =
Sequence Number = 47702
User = ACME\SYSTEM
Connected User =
Shell ID = Microsoft.PowerShell
