Update cs_makekeystrokespath.rb

outflanknl · Jul 19, 2024 · 18c5ef4 · 18c5ef4
1 parent 1ed283e
commit 18c5ef4
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/elkserver/mounts/logstash-config/redelk-main/scripts/cs_makekeystrokespath.rb b/elkserver/mounts/logstash-config/redelk-main/scripts/cs_makekeystrokespath.rb
@@ -13,7 +13,8 @@ def filter(event)
 	desktop_session = event.get("[keystrokes][desktop_session]")
 	temppath = logpath.split('/cobaltstrike/server')
 	temppath2 = temppath[1].split(/\/([^\/]*)$/)
-	keystrokespath = "/c2logs/" + "#{host}" + "/cobaltstrike" + "#{temppath2[0]}" + "/keystrokes_" + "#{implant_id}" + "." + "#{desktop_session}" + ".txt"
+	filename = temppath2[1]
+	keystrokespath = "/c2logs/" + "#{host}" + "/cobaltstrike" + "#{temppath2[0]}" + "/" + "#{filename}"
 	event.tag("_rubyparseok")
   	event.set("[keystrokes][url]", keystrokespath)
 	return [event]