Skip to content

Instantly share code, notes, and snippets.

@automine
Last active September 7, 2023 11:18
Show Gist options
  • Save automine/a3915d5238e2967c8d44b0ebcfb66147 to your computer and use it in GitHub Desktop.
Save automine/a3915d5238e2967c8d44b0ebcfb66147 to your computer and use it in GitHub Desktop.
Nice windows event blacklisting
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist3 = EventCode="4688" Message="New Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
blacklist4 = EventCode="4689" Message="Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
@automine
Copy link
Author

Added the |optimize to cover Windows indexers running the splunk-optimize.exe process.

@jpbarron
Copy link

jpbarron commented Jun 8, 2019

Since splunk is limited to 10 blacklists for Windows TA here is how I consolidated a few lines...

blacklist1 = EventCode="(4662|566)" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="(4656|4670|4663|4703|4658|4688)" Message="Account Name:(\W+\w+$)"
blacklist3 = EventCode="4624" Message="An account was successfully logged on"
blacklist4 = EventCode="(4688|4689)" Message="%SplunkUniversalForwarder%"
blacklist5 = EventCode="6278" Message="Network Policy Server granted full access to a user because the host met the defined health policy."

@DaronBaron
Copy link

I wanted to ask where you are filtering the powershell wouldn't you want to leave that in case someone tried to run scripts via powershell?

@Hodgegoblin
Copy link

Hodgegoblin commented Jun 23, 2020

I wanted to ask where you are filtering the powershell wouldn't you want to leave that in case someone tried to run scripts via powershell?

This is blacklisting events for powershell that is run from the path "[C-F]:\Program Files\SplunkUniversalForwarder\bin" which would be scripts run by Splunk UF.

edit: changed drive letter to match regex C-F

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment