Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cobalt Strike enrichment stacktrace errors #291

Open
MarcOverIP opened this issue Dec 9, 2022 · 0 comments
Open

Cobalt Strike enrichment stacktrace errors #291

MarcOverIP opened this issue Dec 9, 2022 · 0 comments
Assignees
Milestone

Comments

@MarcOverIP
Copy link
Member

In a special setup I encountered error like the one below. This might have happened due to multiple daemon.py running at the same time. Im not sure. I've also never seen it before. Nor have I a way to troubleshoot this and come to root cause

Just leaving this info here for future reference. If this does not occur in the coming time at other installations, than I'll just drop this issue.

2022-12-09 15:25:20,955 - ERROR - alarm - daemon.py - run_enrichments -- Error running enrichment enrich_csbeacon: 'process' | StackTrace: Traceback (most recent call last):
  File "/usr/share/redelk/bin/daemon.py", line 82, in run_enrichments
    enrich_dict[enrich_module]["result"] = copy.deepcopy(module_class.run())
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 38, in run
    hits = self.enrich_beacon_data()
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 72, in enrich_beacon_data
    initial_beacon_doc, doc, ["host", "implant", "user", "process"]
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 99, in copy_data_fields
    dst["_source"][field] = src["_source"][field]
KeyError: 'process'

2022-12-09 15:25:20,955 - ERROR - alarm - daemon.py - run_enrichments -- 'process'
Traceback (most recent call last):
  File "/usr/share/redelk/bin/daemon.py", line 82, in run_enrichments
    enrich_dict[enrich_module]["result"] = copy.deepcopy(module_class.run())
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 38, in run
    hits = self.enrich_beacon_data()
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 72, in enrich_beacon_data
    initial_beacon_doc, doc, ["host", "implant", "user", "process"]
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 99, in copy_data_fields
    dst["_source"][field] = src["_source"][field]
KeyError: 'process'
@fastlorenzo fastlorenzo self-assigned this Feb 17, 2023
@fastlorenzo fastlorenzo added this to the v2.0.0-beta.6 milestone Feb 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants