Update cobaltstrike logstash to parse DNS beacon
Add logstash to parse
[metadata] unknown <- 192.168.1.1; computer: UXXXX ; user: user; process: beacon.exe; pid: 9243; os: Windows; version: 10.0; build: 19042; beacon arch: x64 (x64)
@@ -96,6 +96,7 @@ filter {
# - SSH beacons
grok {
match => { "[c2][message]" => [
+ "[metadata](([^\s]*)) unknown (([^\s]*)) %{IPORHOST}((\; computer:)) (?<[host][name]>([^\;]*))((\; user:)) (?<[user][name]>([^\;]*))((\; process:)) (?<[process][name]>([^\;]*))((\; pid:)) (?<[process][pid]>([^\;]*))((\; os:)) (?<[host][os][name]>([^\;]*))((\; version:)) (?<[host][os][version]>([^\;]*))(((\; build:)) (?<[host][os][kernel]>([^\;]*)))?((\; beacon arch:)) (?<[implant][arch]>([^\;]*))",
"[metadata](([^\s]*)) %{IPORHOST:[host][ip_ext]} (([^\s]*)) %{IPORHOST}((\; computer:)) (?<[host][name]>([^\;]*))((\; user:)) (?<[user][name]>([^\;]*))((\; process:)) (?<[process][name]>([^\;]*))((\; pid:)) (?<[process][pid]>([^\;]*))((\; os:)) (?<[host][os][name]>([^\;]*))((\; version:)) (?<[host][os][version]>([^\;]*))(((\; build:)) (?<[host][os][kernel]>([^\;]*)))?((\; beacon arch:)) (?<[implant][arch]>([^\;]*))",
"[metadata](([^\s]*)) beacon_%{NUMBER:[implant][parent_id]} (([^\s]*)) %{IPORHOST}((\; computer:)) (?<[host][name]>([^\;]*))((\; user:)) (?<[user][name]>([^\;]*))((\; process:)) (?<[process][name]>([^\;]*))((\; pid:)) (?<[process][pid]>([^\;]*))((\; os:)) (?<[host][os][name]>([^\;]*))((\; version:)) (?<[host][os][version]>([^\;]*))(((\; build:)) (?<[host][os][kernel]>([^\;]*)))?((\; beacon arch:)) (?<[implant][arch]>([^\;]*))",
"[metadata](([^\s]*)) beacon_%{NUMBER:[implant][parent_id]} (([^\s]*)) %{IPORHOST}((\; computer:)) (?<[host][name]>([^\;]*))((\; user:)) (?<[user][name]>([^\;]*))((\; os:)) (?<[host][os][name]>([^\;]*))"
