diff --git a/src/Sdk/DTLogging/Logging/ValueEncoders.cs b/src/Sdk/DTLogging/Logging/ValueEncoders.cs
index d7f02ae6a66..b3387abd36c 100644
--- a/src/Sdk/DTLogging/Logging/ValueEncoders.cs
+++ b/src/Sdk/DTLogging/Logging/ValueEncoders.cs
@@ -123,8 +123,11 @@ public static String PowerShellPostAmpersandEscape(String value)
                 var secretSection = string.Empty;
                 if (value.Contains("&+"))
                 {
-                    // +1 to skip the letter that got colored
-                    secretSection = value.Substring(value.IndexOf("&+") + "&+".Length + 1);
+                    if (value.Length > value.IndexOf("&+") + "&+".Length + 1)
+                    {
+                        // +1 to skip the letter that got colored
+                        secretSection = value.Substring(value.IndexOf("&+") + "&+".Length + 1);
+                    }
                 }
                 else
                 {
diff --git a/src/Test/L0/HostContextL0.cs b/src/Test/L0/HostContextL0.cs
index 488064ad834..017a7dc294e 100644
--- a/src/Test/L0/HostContextL0.cs
+++ b/src/Test/L0/HostContextL0.cs
@@ -120,6 +120,7 @@ public void DefaultSecretMaskers()
         [InlineData("secret&+secret&secret", "secret&+\x0033[96ms\x0033[0mecret&secret", "***\x0033[96ms\x0033[0m***")]
         [InlineData("secret&+secret&+secret", "secret&+\x0033[96ms\x0033[0mecret&+secret", "***\x0033[96ms\x0033[0m***")]
         [InlineData("secret&+secret&secret&+secret", "secret&+\x0033[96ms\x0033[0mecret&secret&+secret", "***\x0033[96ms\x0033[0m***")]
+        [InlineData("secret&secret&+", "secret&secret&+\x0033[96m\x0033[0m", "***\x0033[96m\x0033[0m")]
         [Trait("Level", "L0")]
         [Trait("Category", "Common")]
         public void SecretSectionMasking(string secret, string rawOutput, string maskedOutput)