elastic / elastic/integrations
[windows]: Powershell operational script block text whitespaces shouldn't be removed before fingerprinting
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Windows [windows]
### Dataset Name
_No response_
### Integration Version
9.3.4
### Agent Version
9.3.4
### Agent Output Type
elasticsearch
### Elasticsearch Version
9.3.4
### OS Version and Architecture
Windows 11
### Software/API Version
_No response_
### Error Message
When a powershell script block is fingerprinted it is first trimmed and the whitespaces are removed. This seems like it is done for performance reasons and to normalize the data, which would make sense in a lot of scenarios.
However powershell script blocks should be fingerprinted in their original state, not without whitespaces. Consider something like:
Get-Item ("C:\temp") vs Get-Item("C:\temp")
One is a correct usage of Get-Item, while the other would be a method call.
Or
1,2 vs 1 ,2
The first one is an array, while the second one would be 2 separate arguments.
Due to the removal of whitespaces before fingerprinting the hashes end up being equal.
i.m.o. removing this gsub operations solves the issue.
https://github.com/elastic/integrations/blob/2429b8c155be1fb694f01679659643891d0ed1c7/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml#L305
### Event Original
_No response_
### What did you do?
Looked at the hashes of powershell script blocks
### What did you see?
Same hash regardless of whitespace.
### What did you expect to see?
Different hashes for similar commands with difference in whitespace.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.