elastic / elastic/integrations

[windows]: Powershell operational script block text whitespaces shouldn't be removed before fingerprinting

Open
#18,698 2 comments 0 reactions 0 assignees View on GitHub
Integration:windows needs:triage Team:Elastic-Agent-Data-Plane
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Windows [windows]

### Dataset Name

_No response_

### Integration Version

9.3.4

### Agent Version

9.3.4

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.3.4

### OS Version and Architecture

Windows 11

### Software/API Version

_No response_

### Error Message

When a powershell script block is fingerprinted it is first trimmed and the whitespaces are removed. This seems like it is done for performance reasons and to normalize the data, which would make sense in a lot of scenarios.

However powershell script blocks should be fingerprinted in their original state, not without whitespaces. Consider something like:

Get-Item ("C:\temp") vs Get-Item("C:\temp")

One is a correct usage of Get-Item, while the other would be a method call.
Or

1,2 vs 1 ,2

The first one is an array, while the second one would be 2 separate arguments.
Due to the removal of whitespaces before fingerprinting the hashes end up being equal.

i.m.o. removing this gsub operations solves the issue.
https://github.com/elastic/integrations/blob/2429b8c155be1fb694f01679659643891d0ed1c7/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml#L305

### Event Original

_No response_

### What did you do?

Looked at the hashes of powershell script blocks

### What did you see?

Same hash regardless of whitespace.

### What did you expect to see?

Different hashes for similar commands with difference in whitespace.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.