Cobalt Strike parsing of c2 operator join/leave messages
@@ -49,6 +49,13 @@ filter {
mutate {
replace => { "[c2][log][type]" => "events_joinleave" }
}
+
+ grok {
+ match => { "[c2][message]" => [
+ "\*\*\* (?<[c2][operator]>([^\()]*)) \(%{IP:[c2][operator_ip]}\) joined",
+ "\*\*\* %{GREEDYDATA:[c2][operator]} quit"
+ ]}
+ }
}
}
