Check for consistent usage of c2.log.type field

[MarcOverIP]

Check if terms used in c2.log.type are consistent across multiple C2 frameworks. Especially pay attention to beacon, implant_input and implant_task

[MarcOverIP]

The main difference is that CS starts with c2.log.type=beacon instead of implant like Stage1. Because of some incorrect logstash filtering of Cobalt Strike logs, for every log that starts with [note] the value of c.2.log.type stays beacon

Frankly, this is good enough. Closing this issue now.

Stage1

events (becomes one of)

• events_newimplant

implant (becomes one of)

• implant_newimplant
• implant_task
• implant_output
• downloads

Cobalt Strike

events (becomes one of)

• events_newimplant
• events_joinleave

beacon (becomes one of)

• implant_newimplant
• implant_task
• implant_checkin
• implant_input
• ioc
• implant_output
• implant_error

screenshots (stays the same) keystrokes (stays the same) downloads (stays the same) credentials (stays the same)

PoSHC2

events (becomes one of)

• implant_newimplant
• screenshots
• downloads
• messages