Match command output with command input (beacon_commands)

[breakid]

Due to the way Cobalt Strike works (i.e., out-of-order execution and logging output with no information linking it to it's associated input), it is non-trivial to link input and output during post-processing. That said, it should be possible to limit the potential matches, potentially down to one in some cases.

Case 1:

• Error output reported by Cobalt Strike appears immediately after an invalid command. This would be an easy win.

Case 2:

• If there is only one input queued before a check-in, all output before the next input should be related to that one input (even if there are multiple output chunks).

Case 3:

• There is only one input of each output type before a check-in. In this case, with accurate output parsing, it should be possible to link the outputs to the inputs, even if they are executed out of order.

If there are multiples of each command, such as multiple dsqueries, it becomes extremely difficult to match input to output.