Skip to content

Instantly share code, notes, and snippets.

@automine
Last active September 7, 2023 11:18
Show Gist options
  • Save automine/a3915d5238e2967c8d44b0ebcfb66147 to your computer and use it in GitHub Desktop.
Save automine/a3915d5238e2967c8d44b0ebcfb66147 to your computer and use it in GitHub Desktop.
Nice windows event blacklisting
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist3 = EventCode="4688" Message="New Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
blacklist4 = EventCode="4689" Message="Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
@Hodgegoblin
Copy link

Hodgegoblin commented Jun 23, 2020

I wanted to ask where you are filtering the powershell wouldn't you want to leave that in case someone tried to run scripts via powershell?

This is blacklisting events for powershell that is run from the path "[C-F]:\Program Files\SplunkUniversalForwarder\bin" which would be scripts run by Splunk UF.

edit: changed drive letter to match regex C-F

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment