Skip to content

Commit 6a26692

Browse files
MarcOverIPMarcOverIP
authored
Merge pull request #82 from fastlorenzo/fake-data-ingestion
[dev] Add sample data ingestor
2 parents 2c6f693 + e5193ee commit 6a26692

34 files changed

Lines changed: 12007 additions & 0 deletions

‎elkserver/mounts/sample-data/filebeat.yml‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
filebeat.inputs:
2+
3+
# BEGIN REDIRECTORS CONFIG
4+
- type: log
5+
enabled: true
6+
fields_under_root: true
7+
paths:
8+
- /var/log/sample-data/haproxy.log
9+
fields:
10+
infra:
11+
log:
12+
type: redirtraffic
13+
redir:
14+
program: haproxy
15+
- type: log
16+
enabled: true
17+
fields_under_root: true
18+
paths:
19+
- /var/log/sample-data/apache2.log
20+
fields:
21+
infra:
22+
log:
23+
type: redirtraffic
24+
redir:
25+
program: apache
26+
- type: log
27+
enabled: true
28+
fields_under_root: true
29+
paths:
30+
- /var/log/sample-data/nginx.log
31+
fields:
32+
infra:
33+
log:
34+
type: redirtraffic
35+
redir:
36+
program: nginx
37+
# END REDIRECTORS CONFIG
38+
39+
# BEGIN COBALT STRIKE CONFIG
40+
- type: log
41+
scan_frequency: 5s
42+
enabled: true
43+
fields_under_root: true
44+
paths:
45+
- /var/log/sample-data/cobaltstrike/logs/*/events.log
46+
fields:
47+
infra:
48+
log:
49+
type: rtops
50+
c2:
51+
program: cobaltstrike
52+
log:
53+
type: events
54+
55+
- type: log
56+
scan_frequency: 5s
57+
enabled: true
58+
fields_under_root: true
59+
paths:
60+
- /var/log/sample-data/cobaltstrike/logs/*/weblog.log
61+
fields:
62+
infra:
63+
log:
64+
type: rtops
65+
c2:
66+
program: cobaltstrike
67+
log:
68+
type: weblog
69+
70+
- type: log
71+
scan_frequency: 5s
72+
enabled: true
73+
fields_under_root: true
74+
paths:
75+
- /var/log/sample-data/cobaltstrike/logs/*/downloads.log
76+
fields:
77+
infra:
78+
log:
79+
type: rtops
80+
c2:
81+
program: cobaltstrike
82+
log:
83+
type: downloads
84+
85+
- type: log
86+
scan_frequency: 5s
87+
enabled: true
88+
fields_under_root: true
89+
paths:
90+
- /var/log/sample-data/cobaltstrike/data/export_credentials.tsv
91+
fields:
92+
infra:
93+
log:
94+
type: rtops
95+
c2:
96+
program: cobaltstrike
97+
log:
98+
type: credentials
99+
100+
- type: log
101+
scan_frequency: 5s
102+
enabled: true
103+
fields_under_root: true
104+
paths:
105+
- /var/log/sample-data/cobaltstrike/logs/*/*/beacon_*.log
106+
- /var/log/sample-data/cobaltstrike/logs/*/*/ssh_*.log
107+
# Since Cobalt Strike version 3.14 the time format in the logs is changed. Here we use regex 'or' function (expr1)|(expr2) to match new or old format
108+
multiline.pattern: '(^\d\d\/\d\d\s\d\d\:\d\d\:\d\d\sUTC\s\[)|(^\d\d\/\d\d\s\d\d\:\d\d\:\d\d\s\[)' # match "06/19 12:32:56 UTC [" or "06/19 12:32:56 ["
109+
multiline.negate: true
110+
multiline.match: after
111+
multiline.max_lines: 100000
112+
fields:
113+
infra:
114+
log:
115+
type: rtops
116+
c2:
117+
program: cobaltstrike
118+
log:
119+
type: beacon
120+
121+
- type: log
122+
scan_frequency: 5s
123+
enabled: true
124+
fields_under_root: true
125+
paths:
126+
- /var/log/sample-data/cobaltstrike/logs/*/*/keystrokes/keystrokes_*.txt
127+
# Since Cobalt Strike version 3.14 the time format in the logs is changed. Here we use regex 'or' function (expr1)|(expr2) to match new or old format
128+
multiline.pattern: '(^\d\d\/\d\d\s\d\d\:\d\d\:\d\d\sUTC\s\[)|(^\d\d\/\d\d\s\d\d\:\d\d\:\d\d\s\[)' # match "06/19 12:32:56 UTC [" or "06/19 12:32:56 ["
129+
multiline.negate: true
130+
multiline.match: after
131+
multiline.max_lines: 100000
132+
fields:
133+
infra:
134+
log:
135+
type: rtops
136+
c2:
137+
program: cobaltstrike
138+
log:
139+
type: keystrokes
140+
141+
- type: log
142+
scan_frequency: 5s
143+
enabled: true
144+
fields_under_root: true
145+
paths:
146+
- /var/log/sample-data/cobaltstrike/logs/*/*/screenshots.log
147+
# Since Cobalt Strike version 3.14 the time format in the logs is changed. Here we use regex 'or' function (expr1)|(expr2) to match new or old format
148+
multiline.pattern: '(^\d\d\/\d\d\s\d\d\:\d\d\:\d\d\sUTC\s\[)|(^\d\d\/\d\d\s\d\d\:\d\d\:\d\d\s\[)' # match "06/19 12:32:56 UTC [" or "06/19 12:32:56 ["
149+
multiline.negate: true
150+
multiline.match: after
151+
multiline.max_lines: 100000
152+
fields:
153+
infra:
154+
log:
155+
type: rtops
156+
c2:
157+
program: cobaltstrike
158+
log:
159+
type: screenshots
160+
161+
# END COBALT STRIKE CONFIG
162+
163+
filebeat.config.modules:
164+
path: ${path.config}/modules.d/*.yml
165+
reload.enabled: false
166+
167+
setup.template.settings:
168+
index.number_of_shards: 3
169+
170+
name: "sample-client"
171+
fields_under_root: true
172+
fields:
173+
infra:
174+
attack_scenario: sample-scenario
175+
176+
output.logstash:
177+
hosts: ["redelk-logstash:5044"]
178+
ssl.certificate_authorities: ["/usr/share/filebeat/redelkCA.crt"]
179+
ssl.verification_mode: none

‎elkserver/mounts/sample-data/logs/apache2.log‎

Whitespace-only changes.

‎elkserver/mounts/sample-data/logs/cobaltstrike/logs/200329/10.99.1.4/beacon_1233239984.log‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
03/29 15:18:46 UTC [metadata] 13.80.254.1 <- 10.99.1.4; computer: LabMaster; user: outflank *; process: testbeacon.exe; pid: 2004; os: Windows; version: 6.2; beacon arch: x64 (x64)
2+
03/29 15:19:00 UTC [input] <neo> upload
3+
03/29 15:19:15 UTC [input] <neo> pwd
4+
03/29 15:19:15 UTC [task] <> Tasked beacon to print working directory
5+
03/29 15:19:19 UTC [checkin] host called home, sent: 8 bytes
6+
03/29 15:19:20 UTC [output]
7+
Current directory is C:\Users\outflank\Desktop
8+
9+
03/29 15:19:39 UTC [input] <neo> cd \windows\temp
10+
03/29 15:19:39 UTC [task] <> cd \windows\temp
11+
03/29 15:19:39 UTC [checkin] host called home, sent: 21 bytes
12+
03/29 15:19:40 UTC [input] <neo> pwd
13+
03/29 15:19:40 UTC [task] <> Tasked beacon to print working directory
14+
03/29 15:19:43 UTC [checkin] host called home, sent: 8 bytes
15+
03/29 15:19:43 UTC [output]
16+
Current directory is C:\windows\temp
17+
18+
03/29 15:19:49 UTC [input] <neo> upload
19+
03/29 15:19:56 UTC [task] <> Tasked beacon to upload C:\Users\outflank\Desktop\OfferNr2020F6592_salary.doc as OfferNr2020F6592_salary.doc
20+
03/29 15:19:56 UTC [indicator] file: f06d1ae4cbde03cde3898f05b841850f 150016 bytes OfferNr2020F6592_salary.doc
21+
03/29 15:19:58 UTC [checkin] host called home, sent: 150055 bytes
22+
03/29 15:20:21 UTC [input] <neo> ls
23+
03/29 15:20:21 UTC [task] <> Tasked beacon to list files in .
24+
03/29 15:20:21 UTC [checkin] host called home, sent: 19 bytes
25+
03/29 15:20:21 UTC [output]
26+
C:\windows\temp\*
27+
D 0 03/29/2020 15:20:01 .
28+
D 0 03/29/2020 15:20:01 ..
29+
D 0 03/29/2020 11:18:45 C4663637-44E3-43AA-9240-B6235C0B5998-Sigs
30+
F 33311 03/29/2020 09:50:19 chrome_installer.log
31+
D 0 03/29/2020 09:37:54 Crashpad
32+
F 0 03/29/2020 09:27:39 DMI6A08.tmp
33+
D 0 03/29/2020 09:43:18 hsperfdata_LabMaster$
34+
F 0 03/29/2020 11:24:19 LabMaster-20200329-1124.log
35+
F 8670 03/29/2020 11:25:55 LabMaster-20200329-1125.log
36+
F 14480 03/29/2020 11:25:59 LabMaster-20200329-1125a.log
37+
F 11410 03/29/2020 11:25:59 LabMaster-20200329-1125b.log
38+
F 32790 03/29/2020 11:26:29 LabMaster-20200329-1126.log
39+
F 10400 03/29/2020 11:18:45 MpCmdRun.log
40+
F 18736 03/29/2020 11:18:45 MpSigStub.log
41+
F 150016 03/29/2020 15:19:58 OfferNr2020F6592_salary.doc
42+
F 0 03/29/2020 11:24:19 officeclicktorun.exe_streamserver(202003291124191078).log
43+
F 102 03/29/2020 09:17:42 silconfig.log
44+
D 0 03/29/2020 09:18:28 winrmdone
45+
D 0 03/29/2020 09:18:24 winrmrunning
46+
47+
48+
03/29 15:29:24 UTC [input] <neo> exit
49+
03/29 15:29:24 UTC [task] <> Tasked beacon to exit
50+
03/29 15:29:28 UTC [checkin] host called home, sent: 8 bytes
51+
03/29 15:29:28 UTC [output]
52+
beacon exit.
53+

‎elkserver/mounts/sample-data/logs/cobaltstrike/logs/200329/10.99.1.4/beacon_2019412980.log‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
03/29 14:54:56 UTC [metadata] 13.80.254.1 <- 10.99.1.4; computer: LabMaster; user: outflank *; process: rundll32.exe; pid: 3568; os: Windows; version: 10.0; beacon arch: x86 (x64)
2+
03/29 15:00:18 UTC [input] <MarcS> ps
3+
03/29 15:00:18 UTC [task] <T1057> Tasked beacon to list processes
4+
03/29 15:00:22 UTC [checkin] host called home, sent: 12 bytes
5+
03/29 15:00:22 UTC [output]
6+
[System Process] 0 0
7+
System 0 4 x64 0
8+
smss.exe 4 304 x64 NT AUTHORITY\SYSTEM 0
9+
csrss.exe 416 428
10+
wininit.exe 416 492 x64 NT AUTHORITY\SYSTEM 0
11+
csrss.exe 484 500
12+
winlogon.exe 484 552 x64 NT AUTHORITY\SYSTEM 1
13+
services.exe 492 620 x64 NT AUTHORITY\SYSTEM 0
14+
lsass.exe 492 628 x64 NT AUTHORITY\SYSTEM 0
15+
svchost.exe 620 720 x64 NT AUTHORITY\SYSTEM 0
16+
svchost.exe 620 764 x64 NT AUTHORITY\NETWORK SERVICE 0
17+
svchost.exe 620 876 x64 NT AUTHORITY\SYSTEM 0
18+
dwm.exe 552 908
19+
svchost.exe 620 956 x64 NT AUTHORITY\LOCAL SERVICE 0
20+
svchost.exe 620 1008 x64 NT AUTHORITY\SYSTEM 0
21+
svchost.exe 620 1408 x64 NT AUTHORITY\LOCAL SERVICE 0
22+
svchost.exe 620 1416 x64 NT AUTHORITY\LOCAL SERVICE 0
23+
svchost.exe 620 1560 x64 NT AUTHORITY\NETWORK SERVICE 0
24+
svchost.exe 620 1700 x64 NT AUTHORITY\SYSTEM 0
25+
svchost.exe 620 1840 x64 NT AUTHORITY\SYSTEM 0
26+
svchost.exe 620 2016 x64 NT AUTHORITY\LOCAL SERVICE 0
27+
VSSVC.exe 620 2024 x64 NT AUTHORITY\SYSTEM 0
28+
spoolsv.exe 620 1168 x64 NT AUTHORITY\SYSTEM 0
29+
svchost.exe 620 1360 x64 NT AUTHORITY\SYSTEM 0
30+
svchost.exe 620 1960 x64 NT AUTHORITY\SYSTEM 0
31+
MsMpEng.exe 620 1988 x64 NT AUTHORITY\SYSTEM 0
32+
svchost.exe 620 2436 x64 NT AUTHORITY\NETWORK SERVICE 0
33+
WaAppAgent.exe 620 3244 x64 NT AUTHORITY\SYSTEM 0
34+
LogonUI.exe 552 3412 x64 NT AUTHORITY\SYSTEM 1
35+
rundll32.exe 876 3656 x64 NT AUTHORITY\SYSTEM 0
36+
rundll32.exe 876 3772 x64 NT AUTHORITY\SYSTEM 0
37+
WindowsAzureTelemetryService.exe 620 3980 x64 NT AUTHORITY\SYSTEM 0
38+
WindowsAzureGuestAgent.exe 620 2384 x64 NT AUTHORITY\SYSTEM 0
39+
WaSecAgentProv.exe 3244 688 x64 NT AUTHORITY\SYSTEM 0
40+
conhost.exe 688 3900 x64 NT AUTHORITY\SYSTEM 0
41+
svchost.exe 620 1504 x64 NT AUTHORITY\NETWORK SERVICE 0
42+
msdtc.exe 620 2236 x64 NT AUTHORITY\NETWORK SERVICE 0
43+
WindowsAzureNetAgent.exe 620 3896 x64 NT AUTHORITY\SYSTEM 0
44+
VFPlugin.exe 3896 2932 x64 NT AUTHORITY\SYSTEM 0
45+
conhost.exe 2932 3576 x64 NT AUTHORITY\SYSTEM 0
46+
csrss.exe 440 1312
47+
winlogon.exe 440 2980 x64 NT AUTHORITY\SYSTEM 2
48+
dwm.exe 2980 1288
49+
rdpclip.exe 2436 2920 x64 LabMaster\outflank 2
50+
RuntimeBroker.exe 720 808 x64 LabMaster\outflank 2
51+
sihost.exe 876 2368 x64 LabMaster\outflank 2
52+
explorer.exe 2136 3636 x64 LabMaster\outflank 2
53+
svchost.exe 620 2632 x64 LabMaster\outflank 2
54+
taskhostw.exe 876 3368 x64 LabMaster\outflank 2
55+
ShellExperienceHost.exe 720 4664 x64 LabMaster\outflank 2
56+
SearchUI.exe 720 4760 x64 LabMaster\outflank 2
57+
powershell.exe 808 3084 x64 LabMaster\outflank 2
58+
conhost.exe 3084 4844 x64 LabMaster\outflank 2
59+
svchost.exe 620 3812 x64 NT AUTHORITY\LOCAL SERVICE 0
60+
taskhostw.exe 876 5548 x64 LabMaster\outflank 2
61+
OfficeClickToRun.exe 620 4216 x64 NT AUTHORITY\SYSTEM 0
62+
fontdrvhost.exe 2980 4908
63+
AppVShNotify.exe 4216 2172 x64 LabMaster\outflank 2
64+
mstsc.exe 3636 2196 x64 LabMaster\outflank 2
65+
mstsc.exe 3636 4900 x64 LabMaster\outflank 2
66+
javaw.exe 3272 3832 x64 LabMaster\outflank 2
67+
testbeacon.exe 3636 3324 x64 LabMaster\outflank 2
68+
testbeacon-longhaul.exe 3636 5792 x64 LabMaster\outflank 2
69+
notepad.exe 3636 4804 x64 LabMaster\outflank 2
70+
chrome.exe 808 1060 x64 LabMaster\outflank 2
71+
chrome.exe 1060 2888 x64 LabMaster\outflank 2
72+
chrome.exe 1060 4640 x64 LabMaster\outflank 2
73+
chrome.exe 1060 4240 x64 LabMaster\outflank 2
74+
chrome.exe 1060 5788 x64 LabMaster\outflank 2
75+
chrome.exe 1060 4052 x64 LabMaster\outflank 2
76+
WmiPrvSE.exe 720 5300
77+
chrome.exe 1060 5380 x64 LabMaster\outflank 2
78+
chrome.exe 1060 2508 x64 LabMaster\outflank 2
79+
WINWORD.EXE 5648 5096 x86 LabMaster\outflank 2
80+
rundll32.exe 5096 3568 x86 LabMaster\outflank 2
81+
WmiPrvSE.exe 720 2868
82+
83+
84+
03/29 15:00:35 UTC [input] <MarcS> screenshot
85+
03/29 15:00:35 UTC [task] <T1113, T1093> Tasked beacon to take screenshot
86+
03/29 15:00:36 UTC [checkin] host called home, sent: 162370 bytes
87+
03/29 15:00:37 UTC [output]
88+
received screenshot (253367 bytes)
89+
90+
03/29 15:01:00 UTC [input] <MarcS> exit
91+
03/29 15:01:00 UTC [task] <> Tasked beacon to exit
92+
03/29 15:01:01 UTC [checkin] host called home, sent: 8 bytes
93+
03/29 15:01:01 UTC [output]
94+
beacon exit.
95+

‎elkserver/mounts/sample-data/logs/cobaltstrike/logs/200329/10.99.1.4/beacon_496538698.log‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
03/29 13:16:36 UTC [metadata] 13.80.254.1 <- 10.99.1.4; computer: LabMaster; user: outflank *; process: testbeacon.exe; pid: 3324; os: Windows; version: 6.2; beacon arch: x64 (x64)
2+
03/29 13:26:57 UTC [input] <MarcS> screenshot
3+
03/29 13:26:57 UTC [task] <T1113, T1093> Tasked beacon to take screenshot
4+
03/29 13:27:01 UTC [checkin] host called home, sent: 197186 bytes
5+
03/29 13:27:02 UTC [output]
6+
received screenshot (166469 bytes)
7+
8+
03/29 13:54:31 UTC [input] <neo> keylogger
9+
03/29 13:54:31 UTC [task] <T1056, T1093> Tasked beacon to log keystrokes
10+
03/29 13:54:35 UTC [checkin] host called home, sent: 81474 bytes
11+
03/29 13:55:09 UTC [output]
12+
received keystrokes
13+
14+
03/29 13:55:18 UTC [output]
15+
received keystrokes
16+
17+
03/29 13:55:34 UTC [input] <neo> jobkill
18+
03/29 13:55:34 UTC [error] jobkill error: not enough arguments
19+
03/29 13:55:36 UTC [input] <neo> jobs
20+
03/29 13:55:36 UTC [task] <> Tasked beacon to list jobs
21+
03/29 13:55:37 UTC [checkin] host called home, sent: 8 bytes
22+
03/29 13:55:37 UTC [output]
23+
1 0 keystroke logger
24+
25+
26+
03/29 13:55:42 UTC [input] <neo> jobkill 1
27+
03/29 13:55:42 UTC [task] <> Tasked beacon to kill job 1
28+
03/29 13:55:42 UTC [checkin] host called home, sent: 10 bytes
29+
03/29 15:01:06 UTC [input] <MarcS> exit
30+
03/29 15:01:06 UTC [task] <> Tasked beacon to exit
31+
03/29 15:01:08 UTC [checkin] host called home, sent: 8 bytes
32+
03/29 15:01:08 UTC [output]
33+
beacon exit.
34+

‎elkserver/mounts/sample-data/logs/cobaltstrike/logs/200329/10.99.1.4/keystrokes/keystrokes_496538698.txt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
03/29 13:55:09 UTC Received keystrokes
2+
3+
4+
5+
CCobalt Strike
6+
E=======
7+
r2[command]
8+
9+
CRun
10+
E=======
11+
notepad
12+
13+
C
14+
E=======
15+
16+
17+
18+
CUntitled - Notepad
19+
E=======
20+
test for keylogger
21+
03/29 13:55:18 UTC Received keystrokes
22+
23+
- hello :-)

‎elkserver/mounts/sample-data/logs/cobaltstrike/logs/200329/10.99.1.4/screenshots/screen_012702_496538698.jpg‎

163 KB
Loading

‎elkserver/mounts/sample-data/logs/cobaltstrike/logs/200329/10.99.1.4/screenshots/screen_030037_2019412980.jpg‎

247 KB
Loading

0 commit comments

Comments
 (0)