Function Beacon_PostEX_Struct

Struct/Struct.go:1614–1640

()

`
}
func Beacon_PostEX_Struct() string {
	return `
post-ex {
    # control the temporary process we spawn to
	{{.Variables.Post_EX_Process_Name}}

    # change the permissions and content of our post-ex DLLs
    set obfuscate "true";

	# Allows multi-threaded post-ex DLLs to spawn threads with a spoofed start address
	{{.Variables.thread_hint}}

    # pass key function pointers from Beacon to its child jobs
    set smartinject "true";
 
    # disable AMSI in powerpick, execute-assembly, and psinject
    set amsi_disable "false";
	# do not enable this unless needed. Disabling AMSI is an IOC
	
	# control the method used to log keystrokes 
	set keylogger "{{.Variables.Keylogger}}";

	# cleanup the post-ex UDRL memory when the post-ex DLL is loaded 
	set cleanup "true";
}
`
}