Logon Monitor BOF

This Beacon Object File (BOF) facilitates lateral movement in a compromised network by alerting operators to active users on a target host. It performs automated checks every 15 minutes, requiring a SYSTEM-level persistent beacon on the target for effective operation.

Overview

The BOF is executed in memory and primarily uses the WTSEnumerateSessionsW and WTSQuerySessionInformationW Windows APIs to identify active user sessions. An accompanying Aggressor script listens for beacon console messages using the on beacon_output event and forwards them to a configured Slack bot for real-time notifications.

Setup

Prerequisites

• Cobalt Strike with the latest beacon.h from the Arsenal Kit.
• A Slack bot configured for your Slack channel (for messaging functionality).
• MinGW-w64 compiler for compiling the BOF.

Compilation

Compile the C code for x64 architecture with the following command:

x86_64-w64-mingw32-gcc -c logon_monitor.c -o logon_monitor.o

Ensure beacon.h is in the same directory as logon_monitor.c.

Slack Integration

1. Set up a Slack bot for your channel and obtain the bot token.
2. Edit the curl command in the Aggressor script (logon_monitor.cna) with your Slack bot's webhook URL or token.

Usage

1. Load the Aggressor Script:

   • Open Cobalt Strike's Script Manager.
   • Load the logon_monitor.cna script.

2. Start Monitoring:

   • On a beacon, run the command:

     start_logon_monitor

   • This adds the beacon ID to an array, initiating active user checks every 15 minutes (default interval).

3. Stop Monitoring:

   • To stop checks for a specific beacon, run:

     stop_logon_monitor

   • This removes the beacon ID from the global array.

4. Customize Check Interval:

   • Adjust the check interval by modifying the on heartbeat_... function in the Aggressor script. Refer to Fortra's Aggressor Script documentation for available options.

Notes

• The BOF requires SYSTEM-level privileges to function correctly.
• Ensure the Slack bot is properly configured to receive notifications.
• Regularly update beacon.h to maintain compatibility with Cobalt Strike.