bluscreenofjeff

on event_action {
	if (%slack_options["enabled"] eq 'true') {
		sendMessage($3,"$1 - $2");
	}
}

on event_beacon_initial {
	if (%slack_options["enabled"] eq 'true') {
		sendMessage($2,"initial Beacon from $1");
	}

bluscreenofjeff

%slack_options["webhookURL"] = 'https://hooks.slack.com/services/AAAAAAAAA/BBBBBBBBB/CCCCCCCCCCCCCCCCCCCCCCCC';
%slack_options["channel"] = '#pentest';
%slack_options["emoji"] = ':robot_face:';
%slack_options["teamserver"] = localip();
%slack_options["enabled"] = 'false';

sub sendMessage {
    # $1 = timestamp of message, $2 = message
    $timestamp = formatDate($1,"MM/dd/yyyy - HH:mm:ss z");
    @curl_command = @('curl','-X','POST','--data-urlencode','payload={"username": "Cobalt Strike Bot", "icon_emoji": "' . %slack_options["emoji"] . '", "channel": "' . %slack_options["channel"] . '", "attachments" : [{ "pretext":"Server: ' . %slack_options["teamserver"] . ' Timestamp: ' . $timestamp . '" , "text" : "' . $2 . '"}]}',%slack_options["webhookURL"]);

bluscreenofjeff

Keybase proof

I hereby claim:

• I am bluscreenofjeff on github.
• I am bluescreenofjeff (https://keybase.io/bluescreenofjeff) on keybase.
• I have a public key ASD94WLwU4DF2XQPHsEbHmDYPdTfrwQVj76BpGWgl_hXSAo

To claim this, I am signing this object: