bugfix for stage1 download file parsing
@@ -157,7 +157,7 @@ filter {
# Matching lines like: Downloaded C:\Users\ieuser.CONTOSO\Desktop\Stage1-Syscall_x64_Release.exe 305 kb [1592230528_125IJU9I] Stage1-Syscall_x64_Release.exe;
grok {
- match => { "implant_output" => " Downloaded (?<[file][path]>(.|\r|\n)*) %{INT} (kb|mb|b|gb) \[(?<[file][directory_local]>([^\]]*))] (?<[file][name]>([^\;]*));" }
+ match => { "[implant][output]" => " Downloaded %{PATH:[file][directory]}\\(?<[file][name]>([^\;]*)) %{INT} (kb|mb|b|gb) \[(?<[file][directory_local]>([^\]]*))] %{GREEDYDATA}" }
}
# Add path/URI value to the full implant.log file
