Splunk Search

How to parse Powershell event logs?

HackerHurricane
Engager

I am trying to read the DETAILS: section of the Powershell logs in Splunk to produce reports and split out each line:

    HostName=Windows PowerShell ISE Host
    HostVersion=2.0
    HostId=086c4ff9-071c-410f-a317-041e41e7dfb9
    EngineVersion=2.0
    RunspaceId=8908cce5-3524-488e-83a3-b9eaa3a50a27
    PipelineId=7
    CommandName=
    CommandType=Script
    ScriptName=
    CommandPath=
    CommandLine=

What happens when you split is you get some odd space or new line character that is not filtering out so the results look like this

CommandPath=    CommandLine=

It's not a space, blank, /r, /n

Anyone got any ideas?

Looks like this:

09/24/2014 02:13:54 PM LogName=Windows PowerShell SourceName=PowerShell EventCode=501 EventType=4 Type=Information ComputerName=MY-SYSTEM TaskCategory=Command Lifecycle OpCode=Info RecordNumber=1053 Keywords=Classic Message=Command "" is Stopped.
NewCommandState=Stopped SequenceNumber=230 HostName=ConsoleHost HostVersion=4.0 HostId=3f2ddea1-01c3-4f90-ae5b-bf0beac2093d EngineVersion=4.0 RunspaceId=9cf73319-1b33-412f-ab96-a24018e59bb6 PipelineId=33 CommandName= CommandType=Script ScriptName= CommandPath= CommandLine=

0 Karma
1 Solution

HackerHurricane
Engager

I fixed it with this:

| eval Message1 = replace (Message1,"[\n\r]","!!") | eval MessageC=split(Message1,"!!")

Never had to do this with the Windows Logs... odd return messing up things.

Works:
index=Workstation LogName="Powershell" | eval Message=split(Message,". ") | eval Message=mvindex(Message,0) | eval MessageA=split(_raw,"Details:") | eval Message1=mvindex(MessageA,1) | eval Message1 = replace (Message1,"[\n\r]","!!") | eval MessageC=split(Message1,"!!") | eval Message2=mvindex(MessageC,2) | eval Message3=mvindex(MessageC,3) | eval Message4=mvindex(MessageC,4) | eval Message4=split(Message4,"=") | eval PS_Ver=mvindex(Message4,1) | eval Message5=mvindex(MessageC,5) | eval Message6=mvindex(MessageC,6) | eval Message6=split(Message6,"=") | eval Engine_Ver=mvindex(Message6,1) | eval Message7=mvindex(MessageC,7) | eval Message8=mvindex(MessageC,8) | eval Message8=split(Message8,"=") | eval PLine_ID=mvindex(Message8,1) | eval Message9=mvindex(MessageC,9) | eval Message9=split(Message9,"=") | eval Command_Name=mvindex(Message9,1) | eval Message10=mvindex(MessageC,10) | eval Message10=split(Message10,"=") | eval Command_Type=mvindex(Message10,1) | eval Message11=mvindex(MessageC,11) | eval Message11=split(Message11,"=") | eval Script_Name=mvindex(Message11,1) | eval Message12=mvindex(MessageC,12) | eval Message12=split(Message12,"=") | eval Command_Path=mvindex(Message12,1) | eval Message13=mvindex(MessageC,13) | eval Message13=split(Message13,"=") | eval Command_Line=mvindex(Message13,1) | table _time, host, ComputerName, TaskCategory, Message, PS_Ver, Engine_Ver, PLine_ID, Command_Name, Command_Type, Script_Name, Command_Path, Command_Line

View solution in original post

HackerHurricane
Engager

I fixed it with this:

| eval Message1 = replace (Message1,"[\n\r]","!!") | eval MessageC=split(Message1,"!!")

Never had to do this with the Windows Logs... odd return messing up things.

Works:
index=Workstation LogName="Powershell" | eval Message=split(Message,". ") | eval Message=mvindex(Message,0) | eval MessageA=split(_raw,"Details:") | eval Message1=mvindex(MessageA,1) | eval Message1 = replace (Message1,"[\n\r]","!!") | eval MessageC=split(Message1,"!!") | eval Message2=mvindex(MessageC,2) | eval Message3=mvindex(MessageC,3) | eval Message4=mvindex(MessageC,4) | eval Message4=split(Message4,"=") | eval PS_Ver=mvindex(Message4,1) | eval Message5=mvindex(MessageC,5) | eval Message6=mvindex(MessageC,6) | eval Message6=split(Message6,"=") | eval Engine_Ver=mvindex(Message6,1) | eval Message7=mvindex(MessageC,7) | eval Message8=mvindex(MessageC,8) | eval Message8=split(Message8,"=") | eval PLine_ID=mvindex(Message8,1) | eval Message9=mvindex(MessageC,9) | eval Message9=split(Message9,"=") | eval Command_Name=mvindex(Message9,1) | eval Message10=mvindex(MessageC,10) | eval Message10=split(Message10,"=") | eval Command_Type=mvindex(Message10,1) | eval Message11=mvindex(MessageC,11) | eval Message11=split(Message11,"=") | eval Script_Name=mvindex(Message11,1) | eval Message12=mvindex(MessageC,12) | eval Message12=split(Message12,"=") | eval Command_Path=mvindex(Message12,1) | eval Message13=mvindex(MessageC,13) | eval Message13=split(Message13,"=") | eval Command_Line=mvindex(Message13,1) | table _time, host, ComputerName, TaskCategory, Message, PS_Ver, Engine_Ver, PLine_ID, Command_Name, Command_Type, Script_Name, Command_Path, Command_Line

aaronclf
New Member

This was VERY helpful - thanks!! I'm finding that the data Splunk ingests for PowerShell events (i.e. 4103, 4104) is very sloppy. Fields are not getting extracted, etc. Any idea on how I can resolve this? There doesn't seem to be a proper "Splunk_TA_PowerShell" with props.conf & tranforms.conf to clean up the PowerShell event data - am I wrong? Let me know if you know of a solution, or good resource. Thanks!

0 Karma

sk314
Builder

How are you trying to split it?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...