Fixed logstash parsing for Cobalt Strike 3.14
@@ -20,14 +20,13 @@ filter {
if [cslogtype] == "events" {
# Get the timestamp from the log line, and get the rest of the log line
grok {
- match => { "message" => "(?<cstimestamp>%{MONTHNUM}\/%{MONTHDAY} %{HOUR}\:%{MINUTE}) %{GREEDYDATA:csmessage}" }
+ match => { "message" => "(?<cstimestamp>%{MONTHNUM}\/%{MONTHDAY} %{TIME} %{TZ}) %{GREEDYDATA:csmessage}" }
}
# Set the timestamp from the log to @timestamp
date {
- match => [ "cstimestamp", "MM/dd HH:mm" ]
+ match => [ "cstimestamp", "MM/dd HH:mm:ss ZZZ" ]
target => "@timestamp"
- timezone => "Europe/Amsterdam"
}
# matching lines like: *** initial beacon from username@ip (hostname)
@@ -52,14 +51,13 @@ filter {
if [cslogtype] == "beacon" {
# Get the timestamp from the log line, and get the rest of the log line
grok {
- match => { "message" => "(?<cstimestamp>%{MONTHNUM}\/%{MONTHDAY} %{TIME}) %{GREEDYDATA:csmessage}" }
+ match => { "message" => "(?<cstimestamp>%{MONTHNUM}\/%{MONTHDAY} %{TIME} %{TZ}) %{GREEDYDATA:csmessage}" }
}
# Set the timestamp from the log to @timestamp
date {
- match => [ "cstimestamp", "MM/dd HH:mm:ss" ]
+ match => [ "cstimestamp", "MM/dd HH:mm:ss ZZZ" ]
target => "@timestamp"
- timezone => "Europe/Amsterdam"
}
# Add path/URI value to the full beacon.log file
@@ -189,14 +187,13 @@ filter {
if [cslogtype] == "keystrokes" {
# Get the timestamp from the log line, and get the rest of the log line
grok {
- match => { "message" => "(?<cstimestamp>%{MONTHNUM}\/%{MONTHDAY} %{TIME}) %{GREEDYDATA:csmessage}" }
+ match => { "message" => "(?<cstimestamp>%{MONTHNUM}\/%{MONTHDAY} %{TIME} %{TZ}) %{GREEDYDATA:csmessage}" }
}
# Set the timestamp from the log to @timestamp
date {
- match => [ "cstimestamp", "MM/dd HH:mm:ss" ]
+ match => [ "cstimestamp", "MM/dd HH:mm:ss ZZZ" ]
target => "@timestamp"
- timezone => "Europe/Amsterdam"
}
# Set the beacon id from the file name
