Stage1 logstash c2.operator name grok filter
@@ -125,7 +125,7 @@ filter {
# matching lines like: TASKDISTRIBUTED stage1Uid:ZPO0VW0W; taskUid:LDCG4JL38W; taskRequest:getpersistkey; taskRequestparameters:OneDrive;
grok {
- match => { "[c2][message]" => "TASKDISTRIBUTED stage1Uid\:(?<[implant][id]>([^;]*)); taskUid\:(?<[implant][task_id]>([^;]*)); taskRequest\:(?<[implant][task]>([^;]*)); taskRequestparameters\:(?<[implant][task_parameters]>([^;]*));"}
+ match => { "[c2][message]" => "TASKDISTRIBUTED stage1Uid\:(?<[implant][id]>([^;]*)); taskUid\:(?<[implant][task_id]>([^;]*)); (taskOperator\:(?<[c2][operator]>([^;]*)); )?taskRequest\:(?<[implant][task]>([^;]*)); taskRequestparameters\:(?<[implant][task_parameters]>([^;]*));"}
}
}
@@ -137,7 +137,7 @@ filter {
# matching lines like: TASKRESPONSE stage1Uid:LA1JSTG3; taskUid:ITXHK99Z19; taskRequest:pwd; taskRequestparameters:; taskResponse:C:\Users\ieuser\Desktop;
grok {
- match => { "[c2][message]" => "TASKRESPONSE stage1Uid\:(?<[implant][id]>([^;]*)); taskUid\:(?<[implant][task_id]>([^;]*)); taskRequest\:(?<[implant][task]>([^;]*)); taskRequestparameters\:(?<[implant][task_parameters]>([^;]*)); taskResponse\:(?<[implant][output]>(.|\r|\n)*);"}
+ match => { "[c2][message]" => "TASKRESPONSE stage1Uid\:(?<[implant][id]>([^;]*)); taskUid\:(?<[implant][task_id]>([^;]*)); (taskOperator\:(?<[c2][operator]>([^;]*)); )?taskRequest\:(?<[implant][task]>([^;]*)); taskRequestparameters\:(?<[implant][task_parameters]>([^;]*)); taskResponse\:(?<[implant][output]>(.|\r|\n)*);"}
}
# Check if if there was a file downloaded
