Fawkes is a golang Mythic C2 Agent exclusively written by AI.
Fawkes is an entirely vibe-coded Mythic C2 agent. It started as an "I wonder" and has turned into a goal. My goal is to not write a single line of code for this agent, instead, exclusively producing it at a prompt.
I originally attempted to write the agent myself, but after cloning the example container, reading through mythic docs, watching the dev series youtube videos, and copying code from other agents like Merlin or Freyja, I decided I just didn't have time to develop my own agent. A prompt though, that I have time for.
Fawkes is a golang based agent with cross-platform capabilities. It supports Windows (EXE, DLL, and shellcode payloads), Linux (ELF binaries and shared libraries), and macOS (Mach-O binaries for Intel and Apple Silicon). 213 commands total: 113 cross-platform, 82 Windows-only, 21 Unix-only, 11 Linux-only, and 6 macOS-only (some commands have platform-specific implementations sharing one user-facing name, e.g. screenshot). Supports HTTP egress and TCP peer-to-peer (P2P) linking for internal pivoting.
To install Fawkes, you'll need Mythic installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page.
From the Mythic install directory:
./mythic-cli install github https://github.com/galoryber/fawkes
Fawkes supports Mythic Forge command augmentation, which dynamically extends the agent's capabilities with external tool collections. When Forge is installed alongside Mythic, additional commands automatically appear in the Mythic UI for Fawkes callbacks — no agent rebuild required.
Supported tool collections:
| Collection |
|---|
Step 1: Install Forge
cd /path/to/Mythic
sudo ./mythic-cli install github https://github.com/MythicAgents/forge
Step 2: Add Fawkes to Forge's payload type support
Edit InstalledServices/forge/payload_type_support.json and add the Fawkes entry to the JSON array:
{
"agent": "fawkes",
"bof_command": "inline-execute",
"bof_file_parameter_name": "bof_file",
"bof_argument_array_parameter_name": "coff_arguments",
"bof_entrypoint_parameter_name": "function_name",
"inline_assembly_command": "inline-assembly",
"inline_assembly_file_parameter_name": "assembly_file",
"inline_assembly_argument_parameter_name": "assembly_arguments",
"execute_assembly_command": "",
"execute_assembly_file_parameter_name": "",
"execute_assembly_argument_parameter_name": "",
"assembly_default_execution_method": "inline_assembly"
}
This maps Forge's generic parameter interface to Fawkes's specific command names and parameter names. The field mapping:
bof_command → Fawkes's inline-execute command (BOF/COFF execution)inline_assembly_command → Fawkes's inline-assembly command (.NET assembly execution)execute_assembly_command → empty (Fawkes uses inline-assembly for all .NET execution)Step 3: Rebuild and restart
sudo ./mythic-cli build forge
sudo ./mythic-cli restart forge
sudo ./mythic-cli restart fawkes
Step 4: Register tool sources
Open the Mythic UI and use the forge_register command (available on any callback) to register tool sources. Common sources:
To register a source, run forge_register with commandName set to the plain source name (e.g., Rubeus, not forge_net_Rubeus) and remove set to false.
After registration, Forge downloads the tool binaries and creates augmented commands (e.g., forge_net_Rubeus, forge_bof_nanodump) that appear in the callback's command list.
Step 5: Verify
Existing callbacks automatically see Forge commands — no new payload needed. Test by running a registered tool:
autopatch or start-clr first (AMSI patching for .NET tools)forge_net_Seatbelt)-group=system)inline-assembly with the embedded tool binarystart-clr with autopatch first to initialize the CLR and patch AMSI — without this, Windows Defender may block assembly executioninline-execute and inline-assembly commands via the "Forge" parameter grouppayload_type: "forge" in the createTask mutation — without this, Mythic only searches the callback's own payload type| Variant | Technique | Target | Go Shellcode |
|---|---|---|---|
| 1 | Ctrl-C Handler Chain | Console processes only | No |
| 4 | PEB KernelCallbackTable | GUI processes only | Yes |
For detailed variant descriptions, see Injection Technique Details.
When building in shared (DLL) or windows-shellcode mode, the dll_exports build parameter controls which DLL exports are included:
Execution methods with full exports:
Fawkes supports optional binary inflation at build time. This embeds a block of repeated bytes into the compiled agent, which can be used to increase file size or lower entropy scores.
Two build parameters control this:
0x90 or 0x41,0x42)The byte pattern is repeated inflate_count times, so the total added size is length(byte_pattern) * inflate_count.
Quick reference for sizing:
When inflation is not configured, only 1 byte of overhead is added to the binary.
Windows PE binaries contain metadata resources — version info, icons, and UAC manifests — that are visible in File Properties, Task Manager, and Explorer. Default Go binaries have none of this metadata, which is a strong detection signal for security tools and analysts.
Fawkes supports embedding PE resources at build time to impersonate legitimate Windows binaries:
Build parameters:
Presets (10 common Windows binaries with real version info):
notepad, svchost, cmd, explorer, msiexec, dllhost, rundll32, conhost, taskhostw, RuntimeBroker
Individual fields override preset values. When no PE resource parameters are set, the binary is unchanged from default Go output.
Fawkes automatically registers artifacts with Mythic for opsec-relevant commands. Artifacts appear in the Mythic UI under the Artifacts tab, giving operators a clear picture of all forensic indicators generated during an engagement.
Tracked artifact types:
Read-only commands (ls, ps, cat, env, etc.) do not generate artifacts.
Credential-harvesting commands automatically report discoveries to Mythic's Credentials store, making them searchable and exportable from the Mythic UI.
The keylog command integrates with Mythic's Keylogs feature. When keystrokes are returned via stop or dump, they are automatically parsed by window title and sent to Mythic's keylog tracker with user attribution. Keylogs are searchable in the Mythic UI by window title, user, or keystroke content.
The make-token and steal-token commands register tokens with Mythic's Callback Tokens tracker. This provides visibility into which tokens are associated with each callback, including the impersonated user identity and source process. The rev2self command automatically removes tracked tokens when impersonation is dropped.
Control how the agent validates HTTPS certificates when communicating with the C2 server. Configured at build time via the tls_verify parameter:
| Mode | Description |
|---|---|
none | Skip all TLS verification (default, backward compatible) |
system-ca | Validate certificates against the OS trust store |
pinned:<sha256> | Pin to a specific certificate fingerprint (SHA-256 hex). Agent rejects connections if the server cert doesn't match. |
Certificate pinning prevents MITM interception of agent traffic even if an attacker controls a trusted CA.
Go's standard TLS stack produces a distinctive JA3 hash that network security tools can identify as non-browser traffic. The tls_fingerprint build parameter uses uTLS to spoof the TLS ClientHello, producing a browser-matching JA3 fingerprint.
Add client certificate authentication to the HTTP C2 profile. When configured, the agent presents a client certificate during TLS handshake, enabling the C2 server to verify agent identity. This prevents passive HTTPS interception and proxy MITM attacks.
| Parameter | Description |
|---|---|
mtls_cert | PEM-encoded client certificate |
mtls_key | PEM-encoded client private key |
The cert/key are base64-encoded at build time, XOR-encrypted if string obfuscation is enabled, and stored in the AES-256-GCM config vault at runtime. Combines with existing TLS verification modes and JA3 fingerprint spoofing.
Multiple C2 callback URLs with automatic failover. If the primary callback host is unreachable, the agent transparently cycles through fallback URLs before applying backoff.
| Parameter | Description |
|---|---|
fallback_hosts | Comma-separated fallback C2 hosts (e.g. http://backup1.example.com,https://backup2.example.com) |
Same port and encryption as primary. Remembers last successful URL. Works with config vault and XOR obfuscation.
Prevent the agent from executing on unauthorized systems. Configured at build time — the agent silently exits before making any network contact if checks fail. No logging, no artifacts, no C2 traffic.
All patterns are case-insensitive and anchored to match the full value. Multiple keys can be combined — all must pass. Invalid regex patterns fail closed (agent exits). Leave empty to skip a check.
Environmental Key Derivation (env_key_derive): When set, all sensitive C2 config (callback host, UUID, encryption key, URIs, proxy settings, etc.) is AES-256-GCM encrypted at build time using a key derived from the target's environment. At runtime, the agent re-derives the key from its own environment — if it doesn't match (wrong host/domain/user), decryption fails and the agent exits silently. This is stronger than regex matching because the config values are never present in the binary in any form. Requires the corresponding env_key_* values to contain the EXACT target values (not regex patterns). Stacks with obfuscate_strings (XOR layer applied first, then AES-GCM).
Enable the obfuscate_strings build parameter to XOR-encode all C2 config strings (callback host, URIs, user agent, encryption key, UUID) at build time with a per-build random 32-byte key. Prevents trivial IOC extraction via strings on the binary. Decoded at runtime. Cross-platform.
Enable the block_dlls build parameter to apply PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON to all child processes spawned by the agent (run, powershell commands). Prevents EDR from injecting monitoring DLLs into spawned processes. Uses STARTUPINFOEX with UpdateProcThreadAttribute. Windows only.
Set config -action set -key default_ppid -value <PID> at runtime to make all child processes (run, powershell) appear as children of a legitimate process (e.g., explorer.exe). Defeats parent-child process relationship detection by EDR. Combines with BlockDLLs when both are active. Uses UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PARENT_PROCESS). Disable with config -action set -key default_ppid -value 0. Windows only (T1134.004).
Enable the auto_patch build parameter to automatically patch EtwEventWrite and AmsiScanBuffer at agent startup. This prevents ETW-based detection and AMSI scanning before any agent activity occurs — no manual command required. Windows only (no-op on Linux/macOS).
Enable automatic binary deletion at startup via the self_delete build parameter. Once the agent starts running, it removes its own file from disk — eliminating the primary forensic artifact.
os.Remove() — the running process continues via the in-memory inode mapping. The file disappears from disk immediately.:$DATA stream then deletes the file entry. No child process spawned.The binary is deleted after environment key checks pass but before network activity begins.
Set the masquerade_name build parameter to change the agent's process name on Linux. Uses prctl(PR_SET_NAME) to modify /proc/self/comm, which is displayed by ps, top, and htop. Max 15 characters.
Useful names: [kworker/0:1], [migration/0], sshd, apache2, [rcu_preempt]
Combined with self-delete, the agent appears as a legitimate kernel thread or service with no file on disk.
Enable sleep_guard_pages (requires sleep_mask=true) to apply VirtualProtect(PAGE_NOACCESS) on encrypted vault memory during sleep cycles. After the sleep mask encrypts sensitive data (AES-256-GCM) and zeros originals, guard pages move the vault to dedicated VirtualAlloc'd memory and mark it NO_ACCESS. EDR memory scanners, ReadProcessMemory, WinDbg, and Process Hacker get STATUS_ACCESS_VIOLATION when trying to read the vault. Pages are restored to PAGE_READWRITE on wake before decryption. On Linux/macOS, guard pages use mmap(MAP_ANON) + mprotect(PROT_NONE) — probing triggers SIGSEGV.
The sleep vault key is hardware-bound via HKDF-SHA256: a random seed is mixed with a SHA-256 hash of the machine's CPU brand string and UUID. If someone extracts the vault blob from a memory dump and attempts decryption on different hardware, the key derivation produces a different key.
Enable stack_spoof to spoof the sleeping thread's call stack, defeating EDR thread-scanning tools (Hunt-Sleeping-Beacons, Moneta, CrowdStrike).
indirect_syscalls=true): A dedicated native thread performs NtDelayExecution with fake return addresses pointing to kernel32!SleepEx, kernel32!BaseThreadInitThunk, and ntdll!RtlUserThreadStart — the standard thread initialization chain that EDR expects.clone(CLONE_VM) with its own 291-byte machine code stub in anonymous mmap'd memory. The child calls nanosleep directly via raw syscall — no Go runtime or agent code addresses appear on the sleeping thread's stack. Signal handlers are reset to SIG_DFL in the child, and PR_SET_PDEATHSIG ensures the child dies when the parent exits.__ulock_wait/__ulock_wake for synchronization with the Go runtime and calls nanosleep via raw syscall — the sleeping thread's stack shows only the anonymous stub and kernel frames, no Go runtime or agent code.All headers defined in the Mythic HTTP C2 profile configuration are applied to every request. Beyond User-Agent (always supported), operators can add headers like Accept-Language, Referer, Cookie, or X-Forwarded-For to blend C2 traffic with legitimate web traffic patterns.
Set the host_header build parameter to override the HTTP Host header. This enables domain fronting: route traffic through a CDN (e.g., CloudFront, Azure CDN) while the Host header targets your actual C2 domain. To network defenders, the traffic appears to go to the CDN's IP address.
Set the proxy_url build parameter to route agent traffic through an HTTP or SOCKS proxy. Useful for operating in corporate networks with mandatory proxy servers.
Examples: http://proxy.corp.local:8080, socks5://127.0.0.1:1080
Authenticated proxies: Set proxy_user and proxy_pass for Basic authentication. For enterprise proxies requiring Windows domain authentication, also set proxy_domain (e.g., CORP) to enable NTLM authentication. The NTLM handshake (Type1→Type2→Type3) is performed automatically during the CONNECT tunnel establishment.
System proxy detection (Windows): When proxy_url is not set, the agent queries WinHTTP for system proxy settings including PAC/WPAD auto-detection.
All builds use Go's -trimpath flag to strip local filesystem paths from the compiled binary. Without this, paths like /home/user/project/... and /go/pkg/mod/... leak into the binary through panic traces and runtime metadata. Combined with -s -w (symbol stripping) and empty -buildid, this minimizes forensic information in the binary. Garble builds already handle this; -trimpath covers non-garble builds.
After compilation, the built payload is automatically scanned against a set of YARA rules that model common defender detection patterns. Results are shown in the Mythic build output as an informational step — the scan never fails the build.
Detection categories scanned:
This helps operators understand detection risk and choose appropriate opsec options (garble, obfuscate_strings, etc.) before deploying.
The HTTP profile calls back to the Mythic server over the basic, non-dynamic profile. This is the default egress profile — the agent polls Mythic for tasking over HTTP/HTTPS.
Malleable features:
get_uri and post_uri support tokens that are resolved per-request:
{rand:N} — N random hex characters (e.g., /api/{rand:8} → /api/a3f82b1c){int:M-N} — random integer in range (e.g., /v{int:1-3}/status → /v2/status)content_types build parameter to a comma-separated list (e.g., application/json,text/plain,application/x-www-form-urlencoded). The agent cycles through them round-robin. Default: application/x-www-form-urlencoded.user_agent_pool build parameter to a newline-separated list of User-Agent strings. The agent rotates through them per-request, eliminating the static UA fingerprint. Default: single Chrome 134 UA.The TCP profile enables peer-to-peer (P2P) agent linking for internal pivoting. A child agent listens on a TCP port or Windows named pipe and waits for a parent agent to connect via the link command. All tasking and responses are routed through the parent's egress channel (HTTP), so the child never contacts Mythic directly.
Architecture:
Mythic Server ←──HTTP──→ Egress Agent (HTTP profile)
│
├──TCP──→ Child Agent A (TCP profile, port 7777)
├──TCP──→ Child Agent B (TCP profile, port 8888)
└──SMB──→ Child Agent C (named pipe, \\host\pipe\msrpc-f9a1)
Build parameters:
| Parameter | Description | Default |
|---|---|---|
tcp_bind_address |
When tcp_bind_address or namedpipe_bind_name is set, the agent starts in P2P listener mode instead of HTTP egress mode.
Usage workflow (TCP):
tcp_bind_address set (e.g., 0.0.0.0:7777)link -host <child_ip> -port 7777unlink -connection_id <uuid>Usage workflow (Named Pipe):
namedpipe_bind_name set (e.g., msrpc-f9a1)link -connection_type namedpipe -host <child_ip> -pipe_name msrpc-f9a1unlink -connection_id <uuid>Encryption: AES-256-CBC with HMAC-SHA256 (same as HTTP profile). Wire protocol uses 4-byte length-prefixed framing over TCP or named pipe.
Relink support: If a parent disconnects (e.g., via unlink or parent agent dies), the child agent caches its checkin data and waits for a new parent connection. When a new egress agent runs link, the child automatically re-registers with Mythic as a new callback. No manual intervention needed.
Multiple children: An egress agent can link to multiple TCP and named pipe children simultaneously. Each child operates independently with its own callback.
OPSEC notes: Named pipe connections use SMB (port 445) and generate fewer network-level indicators than raw TCP, but Sysmon Event ID 17/18 (PipeEvent) and ETW events from Microsoft-Windows-SMBClient will be logged if configured.
The Discord profile uses a Discord bot and channel as a covert C2 transport. The agent communicates with Mythic by posting encrypted messages to a Discord channel, where a server-side bot relays them to Mythic via gRPC push C2.
Architecture:
Fawkes Agent ──Discord REST API──→ Discord Channel ←──Bot──→ Discord C2 Server ──gRPC──→ Mythic
How it works:
get_tasking request via Discord. With push C2, tasks may also be pushed independently to the channel. The agent collects all matching messages per poll cycle.Build parameters:
Encryption: AES-256-CBC with HMAC-SHA256 (same scheme as HTTP profile). Sensitive configuration (bot token, channel ID) is encrypted in memory after initialization using AES-256-GCM vault.
Push C2 support: The Discord C2 server uses Mythic's push C2 (persistent gRPC stream). Tasks may arrive asynchronously between poll cycles. The agent implements:
Rate limiting: Respects Discord API rate limits with automatic retry and exponential backoff (up to 5 retries). The User-Agent is hardcoded to DiscordBot (https://github.com, 1.0) as required by the Discord API.
Setup prerequisites:
config.jsonKnown limitations:
Everything I know about Mythic Agents came from Mythic Docs or stealing code and ideas from the Merlin and Freyja agents.
After that, it's been exclusively feeding Claude PoC links and asking for cool stuff. Crazy right?
| Command | Syntax | Description |
|---|
| acl-edit | acl-edit -action read -server dc01 -target user | Read/modify Active Directory object DACLs (add/remove ACEs, grant DCSync, GenericAll, backup/restore). Cross-platform (T1222.001, T1098, T1003.006). |
| adcs | adcs -action <cas|templates|find|request|auto-exploit> -server <DC> -username <user@domain> -password <pass> [-ca_name <CA>] [-template <name>] [-alt_name <UPN>] | Enumerate AD Certificate Services, find vulnerable templates (ESC1-ESC4, ESC6 via DCOM), request certificates via DCOM for ESC1/ESC6 exploitation, or auto-exploit (find → parse → request chain). Cross-platform (T1649). |
| ads | ads -action <write|read|list|delete> -file <path> [-stream <name>] [-data <content>] [-hex true] | (Windows only) Manage NTFS Alternate Data Streams — write, read, list, or delete hidden data streams. Supports text and hex-encoded binary. MITRE T1564.004. |
| amcache | amcache -action <query|search|delete|clear> [-name <pattern>] [-count <n>] | Query and clean forensic execution artifacts. Windows: Shimcache. Linux: recently-used.xbel, thumbnails, Tracker. macOS: recent items, KnowledgeC, quarantine (T1070.004). |
| apc-injection | apc-injection [-method <apc|hwbp>] -pid <PID> [-tid <TID>] [-target_api ntdll!NtDelayExecution] [-timeout_ms 30000] | (Windows only) Remote process injection. -method apc (default) queues shellcode via NtQueueApcThread into an alertable thread (use ts to find one). -method hwbp attaches via DebugActiveProcess, sets a DR0 hardware breakpoint on a target API (default ntdll!NtDelayExecution), and redirects Rip to the shellcode when the breakpoint fires — no TID required, no APC queue, no CreateRemoteThread (T1055.004, T1055). |
| audio-capture | audio-capture [-duration 10] [-sample_rate 16000] [-channels 1] [-device default] | Record audio from microphone and upload WAV file. Windows (waveIn), Linux (arecord/parecord), macOS (rec/ffmpeg). Cross-platform (T1123). |
| auditpol | auditpol -action <query|disable|enable|stealth> [-category <name|all>] | (Windows only) Query and modify Windows audit policies. Disable security event logging before sensitive operations. Stealth mode disables detection-critical subcategories. Uses AuditQuerySystemPolicy API (T1562.002). |
| argue | argue -command "cmd.exe /c whoami" -spoof "cmd.exe /c echo hello" | (Windows only) Execute a command with spoofed process arguments. Defeats Sysmon Event ID 1 and EDR command-line telemetry (T1564.010). |
| arp | arp [-ip <subnet>] or arp -action spoof -target <IP> -gateway <IP> | Display ARP table with filtering, or ARP cache poisoning for MITM positioning (T1557.002). Spoof: Linux only, restores on cleanup. |
| asrep-roast | asrep-roast -server <DC> -username <user@domain> -password <pass> [-account <target>] | Request AS-REP tickets for accounts without pre-authentication and extract hashes in hashcat format for offline cracking. Auto-enumerates via LDAP. Cross-platform (T1558.004). |
| av-detect | av-detect [-deep true] | Detect installed AV/EDR/security products by scanning running processes against a 130+ signature database. With --deep, also checks kernel modules, systemd units, and config directories for installed-but-not-running products (Linux). Reports product, vendor, type, and PID. Cross-platform. |
| autopatch | autopatch <dll_name> <function_name> <num_bytes> | (Windows only) Automatically patch a function by jumping to nearest return (C3) instruction. Useful for AMSI/ETW bypasses. |
| base64 | base64 -action <encode|decode|xor|hex|hex-decode|rot13|url|url-decode|caesar> -input <data> [-key <key>] [-shift <N>] [-file true] [-output <path>] | Data encoding toolkit: base64, XOR (with string/hex key), hex, ROT13, URL percent-encoding, Caesar cipher. All support file I/O. Cross-platform (T1132.001, T1140, T1027). |
| bits | bits -action <list|create|persist|cancel|suspend|resume|complete> [-name <job>] [-url <URL>] [-path <local>] [-command <exe>] | (Windows only) Manage BITS transfer jobs for persistence and stealthy file download. Create, suspend, resume, complete jobs and set notification commands for persistence. Jobs survive reboots (T1197). |
| browser | browser [-action <passwords|cookies|history|autofill|bookmarks|downloads>] [-browser <all|chrome|edge|chromium|firefox>] | Harvest browser data from Chromium, Firefox, and Safari. History, autofill, bookmarks, downloads cross-platform. Passwords: Chromium (DPAPI/Keychain/GNOME Keyring), Firefox (key4.db NSS decryption), Safari (macOS Keychain). Firefox cookies on all platforms. MITRE T1555.003, T1217. |
| cat | cat <file> or cat -path <file> -start N -end N -number true | Display file contents with optional line range, numbering, and 5MB size protection. |
| cd | cd <directory> | Change the current working directory. |
| chmod | chmod -path <file> -mode <permissions> [-recursive true] | Modify file/directory permissions with octal (755, 644) or symbolic (+x, u+rw, go-w) notation. Recursive support. Cross-platform (T1222). |
| chown | chown -path <file> -owner <user> [-group <group>] [-recursive true] | (Linux/macOS only) Change file/directory ownership by username/UID and group name/GID. Recursive support (T1222). |
| cert-check | cert-check -host <hostname> [-port 443] [-timeout 10] | Inspect TLS certificates on remote hosts — identifies CAs, self-signed certs, expiry, SANs, TLS version, cipher suites, and SHA256 fingerprints. Cross-platform (T1590.001). |
| certstore | certstore -action <list|find> [-store <MY|ROOT|CA|Trust|TrustedPeople>] [-filter <substring>] | (Windows only) Enumerate Windows certificate stores to find code signing certs, client auth certs, and private keys. Searches CurrentUser and LocalMachine. MITRE T1552.004, T1649. |
| clipboard | clipboard -action <read|write|monitor|dump|stop> [-data "text"] [-interval 3] | Read/write clipboard or continuously monitor for changes with credential pattern detection. Cross-platform (T1115). |
| cloud-metadata | cloud-metadata -action <detect|creds|storage|aws-iam|azure-graph|gcp-iam|aws-s3|azure-blob|gcp-gcs|aws-persist|azure-persist|aws-ssm|azure-keyvault|gcp-secrets|...> [-provider <auto|aws|azure|gcp|do>] | Cloud metadata, credential extraction, IAM enumeration, storage enumeration, persistence, and secret store access. storage/aws-s3/azure-blob/gcp-gcs: enumerate buckets/containers with sample objects. aws-ssm: SSM Parameter Store with decryption. azure-keyvault: Key Vault secrets via managed identity. gcp-secrets: Secret Manager via service account. aws-persist/azure-persist: create long-lived access keys/app registrations. Auto-detect. IMDSv2. Cross-platform (T1552.005, T1580, T1530, T1098.001). |
| compress | compress -action <create|list|extract|stage|exfil|stage-exfil|exfil-https|exfil-github> -path <path> [-format zip|tar.gz] [-output <out>] [-pattern *.txt] [-cleanup true] | Create, list, extract, stage, or exfil archives. Stage encrypts with AES-256-GCM. Exfil transfers to Mythic. exfil-https: upload to S3/Azure/GCS pre-signed URLs with chunked uploads, custom headers, jitter. exfil-github: exfiltrate via GitHub Contents API. Cross-platform (T1560.001, T1074.001, T1041, T1048, T1567, T1567.001). |
| coerce | coerce -server <target> -listener <attacker-ip> [-method petitpotam|printerbug|shadowcoerce|all] -username <user> [-password <pass>] [-hash <NT hash>] [-domain <domain>] | NTLM authentication coercion via MS-EFSR (PetitPotam), MS-RPRN (PrinterBug), MS-FSRVP (ShadowCoerce). Forces target to authenticate to attacker listener. Pass-the-hash support. Cross-platform (T1187). |
| config | config [-action show|set|update] [-key sleep|jitter|killdate|working_hours_start|working_hours_end|working_days] [-value <val>] [-file <binary>] [-hash <sha256>] | View or modify runtime agent configuration, or self-update the agent binary. show/set: sleep, jitter, kill date, working hours. update: download new payload from Mythic, verify, launch, and exit current agent. Cross-platform (T1105). |
| container-detect | container-detect | Detect container runtime and environment (Docker, K8s, LXC, Podman, WSL). Checks escape vectors like Docker sockets and K8s service accounts. Cross-platform (T1082, T1497.001). |
| container-escape | container-escape -action <check|docker-sock|cgroup|nsenter|mount-host|k8s-enum|k8s-secrets|k8s-rbac|k8s-nodes|k8s-etcd|k8s-deploy|k8s-exec> [-command '<cmd>'] [-path <ns>|<ns1,ns2,...>|*] [-kubeconfig /path/to/config] | (Linux only) Container breakout + K8s operations — Docker socket, cgroup, nsenter, host device mount. K8s: enumerate pods/services, read secrets, k8s-rbac: ClusterRole/RoleBinding sweep + privilege-escalation path scoring (crit/warn/info), k8s-nodes: cluster node attack-surface (kubelet/OS/kernel/CIDR/taints/roles), k8s-etcd: discover etcd client endpoints from control-plane pod args + unauthenticated /version probe per endpoint (unauth read = full cluster compromise), deploy/exec pods via API. Out-of-cluster: -kubeconfig accepts stolen kubeconfig files for K8s access from non-container hosts (token + client cert auth) (T1611, T1610, T1613, T1552.007, T1069.003, T1087.004). |
| cp | cp <source> <destination> | Copy a file from source to destination. |
| cred-check | cred-check [-action check|verify-all] -hosts <IPs/CIDRs> -username <DOMAIN\user> -password <pass> [-hash <NTLM>] [-timeout <seconds>] | Test credentials against SMB, WinRM, and LDAP on target hosts. verify-all tests all vault credentials against discovered hosts in parallel. Cross-platform (T1110.001, T1078). |
| cred-harvest | cred-harvest -action <shadow|cloud|configs|history|windows|m365-tokens|browser-live|all|dump-all> [-user <username>] | Harvest credentials: shadow hashes (Unix), cloud configs (AWS/GCP/Azure/K8s), application secrets, shell history scanning for leaked passwords/tokens/API keys, PowerShell history + env vars + RDP (Windows), M365 OAuth/JWT tokens from TokenBroker/Teams/Outlook (Windows), browser-live: steal live cookies, localStorage, sessionStorage via Chrome DevTools Protocol (CDP) from running Chrome/Edge. dump-all: automated subtask chain — runs hashdump + lsa-secrets + cred-harvest all in parallel (Windows). Cross-platform (T1552, T1003.008, T1528, T1539). |
| credential-prompt | credential-prompt [-action dialog|device-code|mfa-phish] [-title "Authentication Required"] [-message "Enter your credentials..."] [-icon caution] | Display native credential dialog, abuse OAuth device code flow, or phish MFA codes. dialog: macOS AppleScript, Windows CredUI, Linux zenity/kdialog. device-code: Azure AD OAuth device code flow for token capture. mfa-phish: fake MFA verification dialog to capture TOTP codes. Cross-platform (T1056.002, T1621, T1111). |
| curl | curl -url <URL> [-method GET|PUT|POST] [-file <path>] [-upload raw|multipart] [-headers '{"K":"V"}'] [-body <data>] | HTTP requests + file upload exfiltration (T1567). Upload to S3 presigned URLs, Azure SAS, generic endpoints. Cross-platform (T1106, T1567.002). |
| cut | cut -path <file> -delimiter <char> -fields <1,3|1-3|2-> [-chars <1-10>] | Extract fields or character ranges from file lines. Custom delimiters, range specs. Cross-platform (T1083). |
| credman | credman [-action <list|dump|vault>] [-filter <pattern>] | Enumerate platform credential stores. Windows: Credential Manager + Vault (CredEnumerateW, vaultcli.dll). Linux: GNOME Keyring (secret-tool), KDE KWallet, NetworkManager WiFi/VPN passwords, GNOME Online Accounts. macOS: Keychain items (generic + internet passwords), WiFi passwords. list=metadata, dump=with secrets, vault=Windows only. MITRE T1555.004, T1555.001. |
| defender | defender -action <status|exclusions|add-exclusion|remove-exclusion|threats|enable|disable> [-type <path|process|extension>] [-value <val>] | (Windows only) Manage Defender — status, exclusions, threats, enable/disable real-time protection. MITRE T1562.001. |
| dpapi | dpapi -action <decrypt|masterkeys|chrome-key> [-blob <base64>] [-entropy <base64>] | (Windows only) DPAPI blob decryption (CryptUnprotectData), master key enumeration, Chrome/Edge encryption key extraction. MITRE T1555.003/T1555.005. |
email -action <count|search|read|folders> [-folder <name>] [-query <keyword>] [-index <n>] | (Windows only) Access Outlook mailbox via COM. Count messages, search by keyword, read by index, list folders. MITRE T1114.001. | |
| dcom | dcom -action <exec|upload|exec-staged|check> -host <target> -command <cmd> [-args <arguments>] [-object mmc20|shellwindows|shellbrowser|wscript|excel|outlook] | (Windows only) Execute commands, upload files, or stage-and-execute on remote hosts via DCOM. check validates RPC/DCOM prerequisites. upload: transfer files via certutil/PowerShell staging. exec-staged: upload then execute with auto-cleanup. Six COM objects. MITRE T1021.003, T1570. |
| debug-detect | debug-detect | Detect attached debuggers, analysis tools, and instrumentation. Windows: IsDebuggerPresent, NtQueryInformationProcess, PEB, DR registers. Linux: TracerPid, LD_PRELOAD, memory maps (Frida/Valgrind/sanitizers), VM/sandbox, eBPF monitoring (Falco/Tetragon/Tracee), auditd framework, ptrace scope. macOS: sysctl P_TRACED, DYLD_INSERT_LIBRARIES, VM detection (sysctl), security products (EDR/AV), sandbox/analysis env. All: debugger process scan (T1497.001). |
| dcsync | dcsync [-action sync|domain-takeover] -server <DC> -username <user> [-password <pass>] [-hash <NT hash>] [-target <account[,account2]>] | DCSync — replicate AD credentials via DRS without touching LSASS. domain-takeover runs kerberoast + asrep-roast + dcsync krbtgt/Administrator in parallel. Cross-platform (T1003.006). |
| df | df [-filesystem <device>] [-mount_point <path>] [-fstype <type>] | Report filesystem disk space usage with optional device, mount point, or fstype filtering. Cross-platform (T1082). |
| diff | diff -file1 <path> -file2 <path> [-context <n>] | Compare two files and show differences in unified diff format. LCS-based algorithm with configurable context lines. Cross-platform (T1083). |
| dns | dns -action <resolve|reverse|srv|mx|ns|txt|cname|all|dc|zone-transfer|wildcard|exfil|doh> -target <host> [-server <dns_ip>] | DNS enumeration — resolve hosts, query records, discover DCs, zone transfers, wildcard detection, DNS-over-HTTPS stealth resolution, DNS exfiltration. Cross-platform (T1018, T1071.004, T1048.001). |
| du | du -path <file_or_dir> [-max_depth <n>] | Report disk usage for files and directories. Size breakdown by subdirectory, sorted by largest. Cross-platform (T1083). |
| drivers | drivers [-filter <name>] | Enumerate loaded kernel drivers/modules. Windows: EnumDeviceDrivers, Linux: /proc/modules, macOS: kext enumeration. Cross-platform (T1082). |
| domain-policy | domain-policy -action <all|password|lockout|fgpp> -server <DC> -username <user@domain> -password <pass> | AD password/lockout policy and FGPP enumeration via LDAP. Spray-safe recommendations. Cross-platform (T1201). |
| crontab | crontab -action <list|add|remove> [-entry <cron_line>] [-program <path>] [-schedule <schedule>] | (Linux/macOS only) List, add, or remove cron jobs for persistence. Supports raw cron entries or program+schedule syntax. |
| download | download <path> or download {"path": "/file", "compress": true} | Download a file or directory from the target. Files >1MB auto-compressed with gzip (configurable). Directories auto-zipped. SHA256 hash verification. Chunked transfer, file browser integration. |
| drives | drives | List available drives/volumes and mounted filesystems with type, label/device, and free/total space. |
| enum-tokens | enum-tokens [-action list|unique] [-user <filter>] | (Windows only) Enumerate access tokens across all processes. list shows PID/user/integrity/session for each process. unique groups by user with process counts. Auto-enables SeDebugPrivilege (T1134, T1057). |
| encrypt | encrypt -action <encrypt|decrypt|encrypt-files|decrypt-files|corrupt|corrupt-files> -path <file_or_glob> [-key <base64key>] [-confirm SIMULATE|CORRUPT] | AES-256-GCM encryption/decryption (T1486) + targeted file corruption (T1565). corrupt: overwrite file headers with random data. Safety gates required for destructive ops. |
| env | env [-action <list|get|set|unset>] [-name <VAR>] [-value <val>] [-filter <pattern>] | List, get, set, or unset environment variables for the agent process. Changes are inherited by child processes. Cross-platform. |
| env-scan | env-scan [-pid <PID>] [-filter <pattern>] | Scan process environment variables for leaked credentials, API keys, and secrets. 35+ detection patterns across cloud, database, CI/CD, and crypto categories. Linux + macOS (T1057, T1552.001). |
| etw | etw -action <sessions|rules|agents|patch|restore|blind-all|...> [-session_name <name>] [-provider <guid|shorthand>] | (Windows, Linux, macOS) Audit/telemetry subsystem manipulation. Windows: ETW sessions/providers stop/blind/blind-all/enable/patch/restore. Linux: auditd rules, journald clear/rotate, syslog config, SIEM agent detection. macOS: unified logging, security agent detection. (T1562, T1070.002). |
| eventlog | eventlog -action <list|query|clear|info|enable|disable> [-channel <name|unit|subsystem|path>] [-event_id <id>] [-filter <xpath|keyword|timewindow>] [-count <max>] | Manage system event logs. Windows: wevtapi.dll channels. Linux: journald units and syslog files. macOS: Unified Logging (os_log) subsystems/processes. List sources, query events, clear/vacuum logs, get info. MITRE T1070.001, T1562.002. |
| execute-memory | execute-memory -arguments 'arg1 arg2' -timeout 60 | Execute a native binary from memory. Linux: memfd_create (no disk write). macOS: temp file with ad-hoc codesign. Windows: temp file with immediate cleanup. All platforms remove artifacts after execution. MITRE T1620. |
| execute-shellcode | execute-shellcode [-technique mmap|memfd] [-encoding none|xor|aes] [-key hex] | Execute shellcode in the current process. Supports XOR/AES-256-CTR encoded shellcode with runtime decoding (T1027). Windows: VirtualAlloc + CreateThread. Linux: mmap (default) or memfd_create. macOS: MAP_JIT (ARM64) or mmap. Cross-platform (T1059.006, T1620). |
| exit | exit | Task agent to exit. |
| file-attr | file-attr -path <file> [-attrs "+hidden,-readonly,+immutable"] | Get or set file attributes — hidden, readonly, system (Windows); immutable, append, nodump (Linux); hidden, immutable (macOS). Omit -attrs to view current flags. Cross-platform (T1564.001, T1222). |
| file-type | file-type -path <file_or_dir> [-recursive true] [-max_files 100] | Identify file types by magic bytes (35+ signatures). Single file or directory scanning. Detects executables, archives, documents, images, databases, media, and more. Cross-platform (T1083). |
| find | find -pattern <glob> [-path <dir>] [-min_size <bytes>] [-max_size <bytes>] [-newer <min>] [-older <min>] [-type f|d] [-perm suid|sgid|writable|executable|<octal>] [-owner <user|uid>] | Search for files by name, size, date, permissions, or owner. Find SUID binaries, world-writable files, files owned by specific users. Cross-platform (T1083). |
| find-admin | find-admin -hosts <targets> -username <user> -password <pass> [-method smb|winrm|both] [-hash <NT>] [-action scan|auto-move] [-lateral_method psexec|wmi] [-lateral_command <cmd>] | Sweep hosts to discover where credentials have admin access via SMB (C$ share) and/or WinRM. auto-move: automated subtask chain — find admin hosts then laterally move to each via psexec/wmi. Supports CIDR, IP ranges, PTH, parallel scanning (T1021.002, T1021.006). |
| firewall | firewall -action <list|add|delete|enable|disable|status|pf-add|pf-delete|pf-list> [-name <rule>] [-direction <in|out>] [-protocol <tcp|udp|any>] [-port <port>] | (Windows, macOS, Linux) Manage firewall rules. Windows: COM API. macOS: ALF + pf anchored rules. Linux: iptables/nftables (auto-detected). PF anchor support for macOS packet filtering. MITRE T1562.004. |
| getprivs | getprivs -action list|enable|disable|strip [-privilege <name>] | (Windows, macOS, Linux) List privileges/capabilities. Windows: token privileges with enable/disable/strip. Linux: process capabilities (CapEff/CapPrm) + SELinux/AppArmor context. macOS: entitlements, sandbox, groups (T1134.002). |
| getsystem | getsystem [-technique steal|potato|check|sudo|osascript] | (Windows, Linux, macOS) Privilege escalation. Windows: SYSTEM via token steal or DCOM potato. Linux: check escalation vectors (SUID, sudo, capabilities, docker) or attempt sudo elevation. macOS: check vectors, sudo, or osascript admin prompt (T1134, T1548). |
| gpp-password | gpp-password -server <DC> -username <user@domain> -password <pass> | Search SYSVOL for GPP XML files with encrypted cpassword attributes and decrypt using the published AES key (MS14-025). Cross-platform via SMB (T1552.006). |
| gpo | gpo -action <list|links|find|all> -server <DC> -username <user@domain> -password <pass> [-filter <name>] | Enumerate Group Policy Objects via LDAP — list GPOs, map links with enforcement, find interesting CSE settings. Cross-platform (T1615). |
| grep | grep -pattern <regex> [-path <dir>] [-extensions .txt,.xml] [-ignore_case] [-max_results 100] | Search file contents for regex patterns. Recursive directory search with extension filtering, context lines, and binary file skipping. Cross-platform (T1083, T1552.001). |
| hash | hash -path <file_or_dir> [-algorithm md5|sha1|sha256|sha512] [-recursive true] [-pattern *.exe] [-max_files 500] | Compute file hashes (MD5, SHA-1, SHA-256, SHA-512). Single files or directories with glob pattern filtering and depth control. Cross-platform (T1083). |
| hexdump | hexdump -path <file> [-offset <bytes>] [-length <bytes>] | Display file contents in xxd-style hex+ASCII format. Offset/length control for examining specific regions, max 4096 bytes. Cross-platform (T1005). |
| handles | handles -pid <pid> [-type File] [-show_names] [-max_count 500] | (Windows, Linux, macOS) Enumerate open handles/file descriptors in a process. Windows: NtQuerySystemInformation. Linux: /proc/pid/fd. macOS: lsof (T1057, T1082). |
| hashdump | hashdump [-action dump|insitu|insitu-full|tickets|auto-spray] [-targets <hosts>] [-format json] | (Windows, Linux, macOS) Extract local account password hashes. Windows: NTLM hashes from SAM registry (requires SYSTEM); insitu: enumerate active logon sessions via in-process LSA APIs (requires admin); insitu-full: open lsass.exe with PROCESS_VM_READ, sigscan lsasrv.dll for LogonSessionList, walk the linked list, overlay the KIWI_MSV1_0_LIST_63 layout on each node to parse LUID/UserName/Domain/AuthPackage/LogonType/Credentials-pointer, walk the per-AuthPackage credential chain at credentials_ptr to capture each KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC envelope, sigscan LsaInitializeProtectedMemory_Internal to recover the IV / h3DesKey / hAesKey BCrypt key globals plus the raw 16-byte IV / 24-byte 3DES / 32-byte AES key bytes, AES-256-CFB / 3DES-CBC decrypt every captured ciphertext blob (selected per-blob by len % 8), and overlay the KIWI_MSV1_0_PRIMARY_CREDENTIAL_10_NEW layout to extract NT/LM/SHA hashes — emitted in username:rid:lm:nt::: format compatible with the dump-action ProcessResponse credential-vault hook (Phase 2B + 2C-i + 2C-ii-a + 2C-ii-b + 2C-ii-c, Win10 21H2 — Win11 23H2, requires admin). Linux: /etc/shadow hashes with hash-type identification (requires root). macOS: Directory Services PBKDF2 hashes from user plists (requires root). auto-spray: dump hashes then automatically spray them via cred-check against target hosts. MITRE T1003.002, T1003.008. |
| history-scrub | history-scrub [-action list|clear|clear-all] [-user <username>] | List or clear shell/application command history files. Covers bash, zsh, fish, PowerShell, python, mysql, and more. Cross-platform (T1070.003). |
| hollow | hollow -filename <shellcode> [-target <process>] [-ppid <pid>] [-block_dlls true] | Process hollowing — create suspended process, write shellcode, redirect execution. Windows: CREATE_SUSPENDED + SetThreadContext, PPID spoofing, DLL blocking, PEB decoration (ImagePath/CommandLine/WindowTitle masking). Linux (amd64/arm64): PTRACE_TRACEME + /proc/mem write. macOS: ptrace + Mach VM APIs (task_for_pid, mach_vm_allocate, mach_vm_write, mach_vm_protect) — requires root. MITRE T1055.012, T1036. |
| ide-recon | ide-recon -action <vscode|jetbrains|all> [-user <filter>] | Enumerate IDE configurations — VS Code extensions, remote SSH hosts, recent projects, settings with secrets. JetBrains data sources, deployment servers, recent projects. Cross-platform (T1005, T1083). |
| ifconfig | ifconfig | List network interfaces with addresses, MAC, MTU, and flags. Cross-platform (Windows/Linux/macOS). |
| inline-assembly | inline-assembly | (Windows only) Execute a .NET assembly in memory using the CLR. Supports command-line arguments. Use start-clr first for AMSI patching workflow. |
| inline-execute | inline-execute | (Windows only) Execute a Beacon Object File (BOF/COFF) in memory. Supports all argument types: strings (z), wide strings (Z), integers (i), shorts (s), and binary (b). |
| reflective-load | reflective-load -dll_b64 <base64_dll> [-function <export>] | (Windows only) Load a native PE (DLL) from memory into the current process. Manual PE mapping with section copying, relocation fixups, import resolution, and DllMain invocation. Optionally call exported functions (T1620). |
| iptables | iptables -action <status|rules|nat|add|delete|flush> [-rule <args>] [-table <name>] | (Linux only) Linux firewall enumeration and management via iptables/nftables/ufw. IP forwarding, connection tracking, rule listing and modification. MITRE T1562.004. |
| jobkill | jobkill -id <task-uuid> | Stop a running task by task ID. Use jobs to list running tasks. Cross-platform. |
| jobs | jobs | List currently running tasks with task ID, command name, and duration. Cross-platform. |
| jxa | jxa -code '<script>' [-timeout 60] or jxa -file /path/to/script.js | (macOS only) Execute JavaScript for Automation (JXA) scripts with ObjC bridge access to Foundation, AppKit, Security frameworks. Supports inline code and file input (T1059.007). |
| kerberoast | kerberoast -server <DC> -username <user@domain> -password <pass> [-spn <SPN>] | Request TGS tickets for SPN accounts and extract hashes in hashcat format for offline cracking. Auto-enumerates via LDAP. Cross-platform (T1558.003). |
| klist | klist -action <list|purge|dump|import> [-server <filter>] [-ticket <base64>] [-path <path>] | Enumerate, dump, purge, and import Kerberos tickets. Import enables Pass-the-Ticket: Windows injects kirbi via LSA, Linux/macOS writes ccache + sets KRB5CCNAME. Cross-platform (T1558, T1550.003). |
| keychain | keychain -action <list|dump|find-password|find-internet|find-cert> [-service <name>] [-server <host>] | (macOS only) Access macOS Keychain — list keychains, dump metadata, find generic/internet passwords, enumerate certificates. |
| kerb-delegation | kerb-delegation -action <all|unconstrained|constrained|rbcd|monitor> -server <DC> -username <user@domain> -password <pass> [-duration <s>] [-interval <s>] | Enumerate Kerberos delegation relationships — unconstrained, constrained (with protocol transition), RBCD. monitor action (Windows/SYSTEM only) polls LSA for incoming TGTs and exports as kirbi blobs. Cross-platform except monitor (T1550.003, T1558). |
| keylog | keylog -action <start|stop|dump|status|clear> | Low-level keyboard logger. Windows: SetWindowsHookEx. Linux: /dev/input evdev. macOS: IOKit HID. Detects Ctrl+V/Cmd+V paste events and captures clipboard content. Window context tracking on all platforms (T1056.001). |
| lateral-check | lateral-check -hosts <IPs/CIDRs> [-timeout <seconds>] | Test lateral movement options against targets — checks SMB, WinRM, RDP, RPC, SSH connectivity and suggests applicable methods. Cross-platform (T1046, T1021). |
| last | last [-action logins|failed|reboot] [-count 25] [-user <username>] | Show login history, failed login attempts, and system boot/shutdown events. Linux: parses wtmp/btmp. Windows: Security/System event logs. macOS: native last + unified log. (T1087.001, T1110, T1082). |
| ldap-query | ldap-query -action <users|computers|groups|domain-admins|spns|asrep|admins|disabled|gpo|ou|password-never-expires|trusts|unconstrained|constrained|dacl|gmsa|bloodhound|query> -server <DC> | Query Active Directory via LDAP. Preset queries for users, computers, groups, domain admins, all admins (adminCount), SPNs, AS-REP roastable, disabled accounts, GPOs, OUs, password-never-expires, domain trusts, unconstrained/constrained delegation, DACL analysis, gMSA password extraction, BloodHound CE v6 collection (users/computers/groups/OUs/GPOs/trusts for graph analysis), or custom LDAP filters. Cross-platform (T1087.002, T1482, T1555, T1003, T1615). |
| ldap-write | ldap-write -action <add-member|remove-member|set-attr|add-attr|remove-attr|set-spn|disable|enable|set-password|shadow-cred|clear-shadow-cred|create-machine|rbcd|delete|gpo-task|gpo-script|template-esc1|template-esc4> -server <DC> -target <obj> | Modify AD objects via LDAP. Group membership, attributes, SPNs, account enable/disable, password reset, shadow credentials, machine account creation, RBCD delegation, object deletion. GPO abuse: inject scheduled tasks (gpo-task) or startup scripts (gpo-script). ADCS: modify certificate templates for ESC1/ESC4 exploitation. Cross-platform (T1098, T1556.006, T1484.001, T1649). |
| kill | kill -pid <PID> | Terminate a process by PID. Cross-platform (Windows/Linux/macOS). |
| laps | laps -server <DC> -username <user@domain> -password <pass> [-filter <computer>] | Read LAPS passwords from AD via LDAP. Supports LAPS v1 (ms-Mcs-AdmPwd) and Windows LAPS v2 (ms-LAPS-Password). Cross-platform (T1552.006). |
| lsa-secrets | lsa-secrets -action <dump|cached> | (Windows only) Extract LSA secrets (service passwords, DPAPI keys, machine account) and cached domain credentials (DCC2/MSCacheV2 hashcat format). Requires SYSTEM (T1003.004, T1003.005). |
| launchagent | launchagent -action <install|remove|list> -label <com.example.name> [-path <exe>] [-daemon true] | (macOS only) Install, remove, or list LaunchAgent/LaunchDaemon persistence. Creates plist with RunAtLoad+KeepAlive. |
| link | link -host <ip> -port <port> [-connection_type tcp|namedpipe] [-pipe_name <name>] | Link to a P2P agent via TCP or named pipe for internal pivoting. Named pipe mode uses SMB port 445 for stealthier Windows traffic. Cross-platform TCP, Windows-only named pipe (T1572). |
| ln | ln -target <existing> -link <new> [-symbolic true] [-force true] | Create symbolic or hard links. Symlinks can point to non-existent paths. Force mode replaces existing link. Cross-platform (T1036). |
| linux-logs | linux-logs -action <list|read|logins|clear|truncate|shred> [-file <path>] [-search <filter>] [-lines <n>] | (Linux only) List, read, clear, or tamper with Linux log files and binary login records (wtmp/btmp/utmp). Supports selective line removal and secure shredding (T1070.002). |
| logonsessions | logonsessions [-action list|users] [-filter <name>] | (Windows, Linux, macOS) Enumerate active logon sessions — users, session IDs, stations, connection state. Filter by username. Windows: WTS API. Linux: utmp parsing. macOS: utmpx parsing. |
| lolbin | lolbin -action <technique> -path <payload/code/URL> [-export <func>] [-args <extra>] | (Windows, Linux, macOS) LOLBin/GTFOBin proxy execution. Windows: rundll32, msiexec, regsvcs, regasm, mshta, certutil, regsvr32, installutil, vbs. Cross-platform: python, lua, perl, ruby, node, awk. Linux: curl, wget, gcc. macOS: osascript, swift, open, curl. T1218/T1059. |
| ls | ls [path] | List files and folders with owner/group and timestamps. File browser integration. Defaults to cwd. |
| make-token | make-token -username <user> -domain <domain> -password <pass> [-action impersonate|spawn|auto-verify -command <cmd>] | (Windows only) Create a token from credentials: impersonate it, spawn a process, or auto-verify (impersonate then whoami + getprivs chain) (T1134.002). |
| masquerade | masquerade -source <file> -technique <type> [-disguise <value>] [-in_place] | File masquerading and hiding — disguise files (double ext, RtLO, space, process match) or hide from enumeration (hide/unhide). Windows: +H/+S attributes. Linux: dot-prefix. macOS: UF_HIDDEN + dot-prefix (T1036, T1564.001). |
| mkdir | mkdir <directory> | Create a new directory (creates parent directories if needed). |
| module-stomp | module-stomp -pid <PID> [-dll_name <DLL>] | (Windows only) Inject shellcode by stomping a legitimate DLL's .text section. Shellcode executes from signed DLL address space, bypassing private-memory detection (T1055.001). |
| modules | modules [-pid <PID>] [-filter <name>] | List loaded modules/DLLs/libraries in a process with optional name filtering. Cross-platform (T1057). |
| mem-scan | mem-scan -pid <PID> -pattern <string> [-hex] [-max_results <n>] [-context_bytes <n>] | Search process memory for byte patterns with hex dump output. Windows: VirtualQueryEx/ReadProcessMemory. Linux: /proc/pid/maps+mem. macOS: mach_vm_region/mach_vm_read (self-scan only). Supports string and hex patterns. Cross-platform (T1005, T1057). |
| mount | mount [-filter <substring>] [-fstype <type>] | List mounted filesystems with device, mount point, type, and options. Supports filtering by name or filesystem type. Cross-platform (T1082). |
| mv | mv <source> <destination> | Move or rename a file from source to destination. |
| named-pipes | named-pipes [-filter <pattern>] | (Windows, Linux, macOS) List named pipes (Windows), Unix domain sockets and FIFOs (Linux/macOS) for IPC discovery. Supports substring filtering (T1083). |
| net-enum | net-enum -action <users|groups|groupmembers|admins|sessions|shares|domainusers|domaingroups|domaininfo|loggedon|mapped> [-target <host>] [-group <name>] | (Windows, Linux, macOS) Cross-platform network enumeration. Users, groups, group members, admins, sessions, shares. Windows: Win32 NetAPI (domain queries, mapped drives). Linux: /etc/passwd + /etc/group + utmp + NFS/Samba. macOS: dscl + who + sharing. (T1033, T1049, T1087, T1135). |
| net-group | net-group -action <list|members|user|privileged> -server <DC> [-group <name>] [-user <sAMAccountName>] -username <user@domain> -password <pass> | Enumerate AD group memberships via LDAP. Recursive member resolution, user group lookup, privileged group enumeration. Cross-platform (T1069.002). |
| net-user | net-user -action <add|delete|info|password|group-add|group-remove|disable|enable|lockout> -username <name> [-password <pass>] [-group <group>] | Manage local user accounts and group membership. Windows: netapi32 API. Linux: useradd/userdel/usermod/chpasswd. macOS: dscl/dseditgroup. Disable/enable/lockout for T1531 ransomware simulation. Cross-platform (T1136.001, T1098, T1531). |
| net-stat | net-stat [-state <LISTEN|ESTABLISHED|...>] [-proto <tcp|udp>] [-port <number>] [-pid <number>] | List active network connections and listening ports with protocol, state, PID, and process name. Supports filtering by state, protocol, port, and process ID. Cross-platform. |
| ntdll-unhook | ntdll-unhook [-action unhook|check] [-dll ntdll.dll|kernel32.dll|kernelbase.dll|advapi32.dll|user32.dll|all] [-source disk|knowndlls] | (Windows only) Remove EDR inline hooks from DLLs by restoring the .text section from a clean copy. Supports 5 DLLs or all. check reports hooks without modification. knowndlls source uses \KnownDlls\ section objects (avoids disk I/O — more OPSEC-friendly) (T1562.001). |
| syscalls | syscalls [-action status|list|init] | (Windows only) Indirect syscall resolver. Parses ntdll exports to resolve Nt* syscall numbers and generates stubs that jump to ntdll's syscall;ret gadget. When active, injection commands bypass userland API hooks (T1106). |
| opus-injection | opus-injection | (Windows only) Callback-based process injection. Variant 1: Ctrl-C Handler Chain. Variant 4: PEB KernelCallbackTable. Details |
| persist | persist -method <method> -action <install|remove|check> | (Windows, Linux, macOS) Install or remove persistence. Windows: registry, startup-folder, com-hijack, screensaver, ifeo, winlogon, print-processor, accessibility, active-setup, time-provider, port-monitor, wmi-event (T1546.003), netsh-helper (T1546.007). Linux: crontab, systemd, shell-profile, ssh-key, xdg-autostart, motd (root, T1546), rc-local (root, T1037.004), apt-hook (root, T1546), udev-rule (root, T1546). macOS: launchagent, periodic (root, T1053.003), folder-action (T1546), login-item (T1547.015), auth-plugin (root, T1547.002), dylib-hijack (T1574.004, scan/install/remove), xpc-service (MachServices + KeepAlive). All methods support install/remove/list. |
| persist-enum | persist-enum [-category <all|platform-specific>] | (Windows, Linux, macOS) Read-only enumeration of persistence mechanisms. Windows: registry, startup, tasks, services. Linux: cron, systemd, shell profiles, SSH keys, LD_PRELOAD, udev rules, kernel modules, motd, at jobs, D-Bus services, PAM modules, package hooks, logrotate scripts, NetworkManager dispatcher, anacron. macOS: LaunchAgents, login items, periodic scripts, auth plugins, emond, at jobs (T1547, T1546, T1053, T1543, T1556). |
| password-managers | password-managers [-depth <N>] | Discover password manager databases and config files — KeePass (.kdbx), 1Password, Bitwarden, LastPass, Dashlane, KeePassXC. Cross-platform (T1555). |
| poolparty-injection | poolparty-injection | (Windows only) Inject shellcode using PoolParty techniques that abuse Windows Thread Pool internals. All 8 variants supported. Details |
| ping | ping -hosts <IP/CIDR/range> [-port 445] or ping -action exfil-icmp -target <IP> -file <path> | TCP connect host reachability (T1018) + ICMP data exfiltration via echo request payloads with XOR encoding and jitter (T1048.003, T1095). |
| pipe-server | pipe-server -action <check|impersonate> [-name <pipe>] [-timeout 30] | (Windows only) Named pipe impersonation for privilege escalation. Create pipe server, wait for privileged client connection, impersonate token. Requires SeImpersonatePrivilege (T1134.001). |
| printspoofer | printspoofer [-timeout 15] | (Windows only) PrintSpoofer privilege escalation — SeImpersonate to SYSTEM via Print Spooler. Creates named pipe, triggers spooler connection via OpenPrinterW, impersonates SYSTEM token. One-step NETWORK SERVICE → SYSTEM (T1134.001). |
| pkg-list | pkg-list [-filter <substring>] | List installed packages and software. Enumerates dpkg/rpm/apk (Linux), Homebrew/Applications (macOS), or registry Uninstall keys (Windows). Supports name filtering. Cross-platform (T1518). |
| port-scan | port-scan -hosts <IPs/CIDRs> [-ports <ports>] [-timeout <s>] | TCP connect scan for network service discovery. Supports CIDR, IP ranges, and port ranges. Cross-platform. |
| powershell | powershell <command> [--encoded] | (Windows only) Execute a PowerShell command via powershell.exe with OPSEC-hardened flags (abbreviated, randomized). Supports encoded command mode to hide args from process tree. |
| prefetch | prefetch -action <list|parse|delete|clear> [-name <exe>] [-count <max>] | (Windows only) Parse and manage Windows Prefetch files. List executed programs, parse run history (up to 8 timestamps), delete specific entries, or clear all. Supports MAM-compressed files (T1070.004). |
| privesc-check | privesc-check -action <all|auto-escalate|privileges|services|registry|uac|dll-hijack|dll-plant|dll-sideload|dll-exports|hijack-execute|hijack-deploy|hijack-cleanup|hijack-trigger|service-registry|...> | Privilege escalation enumeration and exploitation. auto-escalate: automated subtask chain — enumerates all vectors then attempts the best available escalation (UAC bypass, token steal, or sudo). hijack-execute: automated proxy DLL factory — reads target DLL exports, server compiles proxy DLL with embedded shellcode (mingw). hijack-deploy: deploys proxy DLL (renames original, places proxy). hijack-trigger: triggers the hijack — restart a service (-trigger restart -service_name <svc>) or spawn a process (-trigger spawn -source <exe>) to load the proxy DLL. hijack-cleanup: reverses a deployed hijack (deletes proxy, restores original). Windows: token privileges, unquoted services, AlwaysInstallElevated, auto-logon, UAC, unattend files, DLL hijack scanning (phantom DLLs, writable PATH, KnownDLLs), DLL planting with timestomping, DLL sideloading, PE export enumeration (dll-exports with DEF file generation), service registry permission abuse. Linux: SUID/SGID, capabilities, sudo, containers, cron hijacking, NFS no_root_squash, systemd units, sudo tokens, PATH hijacking, docker group, dangerous groups, Polkit rules, modprobe hooks, ld.so.preload injection, security modules (AppArmor/SELinux). macOS: LaunchDaemons, TCC, dylib hijacking, SIP. Cross-platform (T1548, T1574.001, T1574.002, T1574.009, T1574.011). |
| psexec | psexec -host <target> -command <cmd> [-name <svcname>] [-cleanup <true|false>] or psexec -action check -host <target> | (Windows only) Execute commands on remote hosts via SCM service creation — PSExec-style lateral movement. check validates prerequisites (SMB 445, SCM access, admin shares) without executing. MITRE T1021.002, T1569.002. |
| proc-info | proc-info -action <info|connections|mounts|modules> [-pid <PID>] | (Linux only) Deep /proc inspection: process details (cmdline, env, caps, cgroups, namespaces, FDs), network connections with PID resolution, mounts, kernel modules. MITRE T1057. |
| process-mitigation | process-mitigation [-action query|set] [-pid <PID>] [-policy <policy>] | (Windows only) Query or set process mitigation policies (DEP, ASLR, CIG, ACG, CFG). Set CIG to block unsigned DLL loading (EDR defense). MITRE T1480. |
| process-tree | process-tree [-pid <PID>] [-filter <name>] | Display process hierarchy as a tree with parent-child relationships. Helps identify injection targets and security tools. Cross-platform (T1057). |
| procdump | procdump [-action lsass|dump|search] [-pid <PID>] | Dump process memory. Windows: MiniDumpWriteDump with LSASS auto-discovery. Linux: /proc/pid/mem region dumping. Search action finds credential-holding processes. Uploads to Mythic and cleans from disk. MITRE T1003.001, T1003.007. |
| proxy-check | proxy-check [-test_url <URL>] | Detect proxy settings from environment variables, OS config (registry, config files), and Go transport. Optional connectivity test. Cross-platform (T1016). |
| ps | ps [-filter <name>] [-pid <PID>] [-ppid <PPID>] [-user <name>] [-v] | List running processes with Mythic process browser integration. Filter by name, PID, parent PID, or username. Cross-platform. |
| ptrace-inject | ptrace-inject -action <check|inject> [-pid <PID>] [-filename <shellcode>] [-restore <true>] [-timeout <30>] | (Linux only, amd64/arm64) Process injection via ptrace — PTRACE_ATTACH/POKETEXT/SETREGS with register and code restore. Yama ptrace_scope pre-check with actionable guidance. Check mode reports ptrace_scope, capabilities, and candidates (T1055.008). |
| pty | pty [-shell /bin/bash] [-rows 24] [-cols 80] | (Linux/macOS) Start an interactive PTY shell session via Mythic's interactive tasking. Full terminal emulation with bidirectional I/O (T1059). |
| pwd | pwd | Print working directory. |
| read-memory | read-memory <dll_name> <function_name> <start_index> <num_bytes> | (Windows only) Read bytes from a DLL function address. |
| reg | reg -action <read|write|delete|search|save|creds> [-hive HKLM] [-path ...] [...] | (Windows only) Unified registry operations — read, write, delete, search, and save hives (T1012, T1112, T1003.002). |
| remote-reg | remote-reg -action <query|enum|set|delete> -server <host> -username <user> [-password <pass>|-hash <NT>] [-hive HKLM] [-path ...] [-name <val>] | Read/write registry on remote Windows hosts via WinReg RPC over SMB named pipes. Supports pass-the-hash. Cross-platform (T1012, T1112, T1021.002). |
| remote-service | remote-service -action <list|query|create|start|stop|delete|modify-path|trigger|dll-sideload> -server <host> -username <user> [-password <pass>|-hash <NT>] [-name <svc>] [-binpath <path>] | Manage services on remote Windows hosts via SVCCTL RPC. Standard ops + advanced lateral movement: modify-path (hijack existing service binpath), trigger (create trigger-started service), dll-sideload (ServiceDll registry hijack). Pass-the-hash. Cross-platform (T1569.002, T1543.003, T1574.001). |
| rev2self | rev2self | (Windows only) Revert to the original security context by dropping any active impersonation token. |
| route | route [-destination <IP>] [-gateway <IP>] [-interface <name>] | Display the system routing table with optional filtering. Windows: GetIpForwardTable API, Linux: /proc/net/route + IPv6, macOS: netstat -rn. Cross-platform (T1016). |
| rpfwd | rpfwd start <port> <remote_ip> <remote_port> / rpfwd forward <port> <target_ip> <target_port> [bind_addr] / rpfwd stop <port> | Port forwarding: reverse (Mythic routes to target) or forward (agent relays to internal target). Cross-platform (T1090). |
| rm | rm [-path <path>] [-secure true] | Remove a file or directory. -secure true overwrites with random data (3 passes) before deletion, preventing forensic recovery (T1070.004). |
| run | run <command> | Execute a shell command and return the output. |
| runas | runas -command <cmd> -username <user> -password <pass> [-domain <domain>] [-netonly true] | Execute a command as a different user. Windows: CreateProcessWithLogonW (supports /netonly). Linux/macOS: setuid as root, or sudo -S with password. Cross-platform (T1134.002). |
| schtask | schtask -action <create|query|delete|run|list|enable|disable|stop> -name <name> [-program <path>] [-trigger <type>] [-filter <substring>] | Manage scheduled tasks. Windows: Task Scheduler COM API. Linux: crontab, systemd timers, at jobs. macOS: LaunchAgents/LaunchDaemons, crontab, at. Cross-platform (T1053). |
| screenshot | screenshot [-action single|record] [-interval <sec>] [-duration <sec>] [-max_frames <n>] | Capture a single screenshot or record continuous screenshots at intervals. Uploads as PNG. record mode: configurable interval/duration/max_frames, stoppable via jobkill. Windows: GDI. macOS: screencapture. Linux: X11/Wayland auto-detect. Cross-platform (T1113). |
| secret-scan | secret-scan [-path /home/user] [-depth 5] [-max_results 100] | Search files for secrets, API keys, private keys, connection strings, and sensitive patterns. 42 regex patterns (AWS, GitHub, Slack, Stripe, Vault, DigitalOcean, Shopify, Databricks, New Relic, PagerDuty, Okta, Sentry, Datadog, CircleCI, etc.) with value redaction. Depth-limited directory walk, skips noise dirs. Cross-platform (T1552.001, T1005). |
| secure-delete | secure-delete [-action delete|wipe|wipe-mbr] -path <file_or_device> [-passes <n>] [-confirm DESTROY] | Securely delete files, wipe data, or destroy boot records. delete: random overwrite + removal. wipe: aggressive patterned destruction (T1485). wipe-mbr: overwrite MBR/GPT boot record on raw disk device (T1561). Safety gate required. Cross-platform (T1070.004, T1485, T1561). |
| security-info | security-info [-action all|edr|minifilter-enum|kernel-drivers] | Report security posture and active controls, detect EDR/XDR products (20+ vendors), enumerate minifilter drivers with EDR classification, or list loaded kernel drivers with EDR/callback analysis. SELinux/AppArmor/seccomp/ASLR (Linux), SIP/Gatekeeper/FileVault (macOS), Defender/UAC/Credential Guard/BitLocker (Windows). Cross-platform (T1082, T1518.001). |
| sniff | sniff [-action capture|poison|relay|ldap-relay] [-interface eth0] [-duration 30] [-response_ip <target>] [-protocols llmnr,nbtns,mdns] [-ports listen:target] | Network sniffing, poisoning, and NTLM relay. capture: passive credential extraction (HTTP, FTP, NTLM, Kerberos, LDAP, SMTP AUTH, Telnet). poison: active responder with SMB+HTTP hash capture — NTLMv2 hashes in hashcat mode 5600. relay: NTLM relay to target SMB. ldap-relay: NTLM relay to target LDAP with post-auth operations (whoami, add-computer, RBCD, dump-laps) (T1040, T1557.001). |
| share-hunt | share-hunt -hosts <IPs/CIDRs> -username <DOMAIN\user> -password <pass> [-hash <NTLM>] [-depth <n>] [-filter <all|credentials|configs|code>] | Crawl SMB shares across multiple hosts for sensitive files — credentials, configs, scripts. Recursive directory search with pass-the-hash support. Cross-platform (T1135, T1039). |
| smb | smb -action <shares|ls|cat|upload|rm|mkdir|mv|push|exfil|taint|share-perms|share-spider|share-search> -host <target> -username <user> [-password <pass>] [-hash <NT hash>] [-share <name>] [-path <path>] [-depth <n>] [-extensions <.docx,.xlsx>] [-patterns <*.kdbx,web.config>] [-max_results <n>] | SMB2 file operations on remote shares — list, browse, read/write/delete, push for lateral tool transfer, exfil for data exfiltration, taint for planting files. share-perms: test read/write access on all shares. share-spider: recursive directory listing with depth/extension filters. share-search: find sensitive files across shares using built-in or custom patterns. NTLM auth + pass-the-hash. Cross-platform (T1021.002, T1039, T1080, T1135, T1550.002, T1570, T1048.003). |
| service | service -action <query|start|stop|restart|create|delete|list|enable|disable|edr-enum|edr-kill> -name <name> [-binpath <path>] [-confirm EDR-KILL] | (Windows, Linux, macOS) Manage services + EDR/AV targeting. edr-enum: detect installed security services (60+ signatures). edr-kill: stop+disable detected EDR (safety gate required). Windows SCM, Linux systemd, macOS launchd (T1543, T1489, T1562.001). |
| setenv | setenv -action <set|unset> -name <NAME> [-value <VALUE>] | Set or unset environment variables in the agent process. Cross-platform. |
| shell-config | shell-config -action <history|list|read|inject|remove|clear> [-file <.bashrc>] [-line <cmd>] [-lines <count>] | Read shell history, list/read/inject/remove/clear shell config files. Linux/macOS: bashrc/zshrc. Windows: PowerShell profiles + PSReadLine history. T1546.004/T1546.013/T1552.003/T1070.003. |
| sleep | sleep [seconds] [jitter] [working_start] [working_end] [working_days] or sleep -interval 60 -jitter 30 -jitter_profile normal | Set callback interval, jitter, working hours, and jitter distribution profile (uniform/normal/exponential). Normal distribution clusters near interval; exponential mimics bursty human patterns. |
| socks | socks <start|stop|stats|bandwidth> [port] [-bandwidth_kbs N] | Start, stop, view stats, or set bandwidth for SOCKS5 proxy. Supports TCP CONNECT and UDP ASSOCIATE (RFC 1928) relay for DNS/UDP tools through the proxy. Optional per-connection bandwidth limiting in KB/s. Stats shows active connections, bytes TX/RX, recent history. |
| sort | sort -path <file> [-reverse true] [-numeric true] [-unique true] | Sort lines of a file. Supports alphabetic, numeric, reverse, and unique modes. Cross-platform (T1083). |
| spawn | spawn -path <exe> [-ppid <pid>] [-blockdlls true] | (Windows only) Spawn a suspended process or thread for injection. Supports PPID spoofing (T1134.004) and non-Microsoft DLL blocking. |
| spray | spray -action <kerberos|ldap|smb> -server <DC> -domain <DOMAIN> -users <user1\nuser2> [-password <pass>] [-hash <NT hash>] [-delay <ms>] [-jitter <0-100>] | Password spray against AD via Kerberos pre-auth, LDAP bind, or SMB auth. SMB supports pass-the-hash. Lockout-aware with configurable delay/jitter. Cross-platform (T1110.003, T1550.002). |
| ssh | ssh [-action exec|push|check|tunnel-local|tunnel-remote|tunnel-dynamic|tunnel-list|tunnel-stop] -host <target> -username <user> [-password <pass>] [-key_path <path>] [-command <cmd>] [-local_port <port>] [-remote_host <host>] [-remote_port <port>] | Execute commands, push files, or create SSH tunnels. check validates SSH prerequisites (port, auth, shell). tunnel-local (-L), tunnel-remote (-R), tunnel-dynamic (-D SOCKS5). Cross-platform (T1021.004, T1570, T1572). |
| ssh-agent | ssh-agent [-action <list|enum>] [-socket /path/to/agent.sock] | (Linux/macOS only) Enumerate SSH agent sockets and list loaded keys. Discovers SSH_AUTH_SOCK, scans /tmp/ssh-, /run/user/, GNOME keyring. Reports key fingerprints to credential vault (T1552.004). |
| ssh-keys | ssh-keys -action <list|add|remove|read-private|enumerate|generate|find-reachable|try-keys|auto-move> [-key <ssh_key>] [-user <username>] [-targets <range>] [-host <ip>] [-username <user>] [-command <cmd>] | SSH key management and lateral movement automation. Read/inject authorized_keys, read private keys, generate key pairs, enumerate SSH config. Lateral movement: find-reachable (subnet scan), try-keys (test keys), auto-move (chain scan→auth→exec). Windows: PuTTY sessions/registry, .ppk keys, WSL, OpenSSH, Git SSH config. Cross-platform (T1552.004, T1552.002, T1098.004, T1021.004, T1046). |
| stat | stat -path <file_or_dir> | Display file/directory metadata: type, size, permissions, timestamps. Platform-specific details — inode/owner (Linux/macOS), file attributes (Windows). Symlink-aware via Lstat. Cross-platform (T1083). |
| strings | strings -path <file> [-min_length <n>] [-pattern <text>] [-offset <bytes>] [-max_size <bytes>] | Extract printable ASCII strings from files. Find embedded text, URLs, credentials in binaries. Pattern filter, min length control, offset/max_size. Cross-platform (T1005). |
| start-clr | start-clr [-action execute-assembly -assembly <b64> -arguments <args>] | (Windows only) Initialize CLR v4 or execute .NET assemblies. execute-assembly action auto-patches AMSI+ETW and runs assembly in one step (like CS execute-assembly). Manual mode with -amsi_patch/-etw_patch for fine control. |
| systemd-persist | systemd-persist -action <install|remove|list> -name <unit> [-exec_start <cmd>] [-timer <calendar>] [-system true] | (Linux only) Install, remove, or list systemd service/timer persistence. User or system scope. MITRE T1543.002. |
| steal-token | steal-token -pid <pid> [-action spawn -command <cmd>] | (Windows only) Steal a token from another process: impersonate it, or spawn a process with it (T1134.002). |
| token-store | token-store -action <save|list|use|remove|history> -name <label> | (Windows only) Named token vault — save, list, restore, remove, and view identity transition history. Enables quick switching between stolen/created identities without re-stealing (T1134.001). |
| suspend | suspend -action <suspend|resume> -pid <PID> | Suspend or resume a process. Tactical EDR/AV pause during sensitive ops. Windows: NtSuspendProcess/NtResumeProcess. Linux/macOS: SIGSTOP/SIGCONT. Cross-platform (T1562.001). |
| sysinfo | sysinfo [-action info|full-profile] | Comprehensive system information: OS version, hardware, memory, uptime, domain, .NET (Windows), SELinux/SIP status. full-profile runs automated 5-step host profiling chain (sysinfo → ps → security-info → privesc-check → persist-enum). Cross-platform (T1082). |
| sysmon-config | sysmon-config [-action check|rules|events] | (Windows only) Detect Sysmon installation and extract configuration — service/driver status, hash algorithm, options flags, rule data size, event channels. Detects renamed installations via minifilter altitude (T1518.001, T1562.001). |
| tac | tac -path <file> | Print file lines in reverse order. Useful for viewing logs newest-to-oldest. Cross-platform (T1083). |
| tail | tail -path <file> [-lines <N>] [-head true] [-bytes <N>] | Read first or last N lines/bytes of a file without transferring entire contents. Ring buffer for efficient tail, reverse-seek for large files. Cross-platform (T1005, T1083). |
| tcc-check | tcc-check [-service <filter>] | (macOS only) Enumerate TCC (Transparency, Consent, and Control) permissions. Discover which apps have camera, microphone, screen recording, full disk access. Groups by service with allowed summary (T1082). |
| touch | touch -path <file> [-mkdir true] | Create an empty file or update existing file timestamps. Optional parent directory creation. Cross-platform (T1106). |
| thread-hijack | thread-hijack -pid <PID> [-tid <TID>] | (Windows, macOS) Inject shellcode via thread execution hijacking — suspend existing thread, redirect PC/RIP to shellcode, resume. macOS uses Mach APIs (task_for_pid + thread_get/set_state), requires root (T1055.003). |
| threadless-inject | threadless-inject | (Windows only) Inject shellcode using threadless injection by hooking a DLL function in a remote process. More stealthy than vanilla injection as it doesn't create new threads. |
| ticket | ticket -action forge|request|diamond|renew|s4u|pkinit -realm <DOMAIN> -username <user> -key <hex_key> [-key_type aes256|aes128|rc4] [-format kirbi|ccache] [-domain_sid <SID>] [-spn <SPN>] [-server <KDC>] [-impersonate <user>] [-krbtgt_key <hex>] [-target_user <user>] [-ticket <base64>] [-certificate <pem>] [-private_key <pem>] | Forge, request, renew, delegate, or certificate-auth Kerberos tickets. Forge: Golden/Silver Tickets (offline). Request: Overpass-the-Hash (online). Diamond: real AS exchange + ticket modification for evasion. Renew: extend TGT lifetime. S4U: constrained delegation via S4U2Self+S4U2Proxy. PKINIT: certificate-based auth from ADCS/Shadow Creds. Cross-platform (T1558.001, T1558.002, T1550.002, T1134.001, T1649). |
| tr | tr -path <file> -from [:lower:] -to [:upper:] | Translate, squeeze, or delete characters in file content. Supports character classes and ranges. Cross-platform (T1083). |
| triage | triage -action <all|documents|credentials|configs|database|scripts|archives|mail|recent|custom|recon-chain> [-path <dir>] [-hours <n>] [-target <subnet>] [-username <user>] [-password <pass>] | Find high-value files for exfiltration — documents, credentials, configs, databases (.db/.sqlite), scripts (.py/.sh/.ps1), archives (.zip/.tar/.7z), email files (.pst/.eml/.mbox), recently modified files, or custom path scan. recon-chain: automated subtask chain — portscan → SMB share enum → share hunt → local triage (requires target, username/password). Cross-platform (T1083, T1005). |
| trust | trust -server <DC> -username <user@domain> -password <pass> [-use_tls] | Enumerate domain/forest trusts via LDAP with forest topology, transitivity analysis, encryption strength, and attack path identification. Cross-platform (T1482). |
| timestomp | timestomp -action <get|copy|set|match|random|clean-prefetch> -target <file> [-source <file>] [-timestamp <time>] | Modify file timestamps to blend in. Get, copy from another file, set specific time, match directory neighbors (IQR), or random within range. clean-prefetch deletes Windows Prefetch files for a named executable. Windows also modifies creation time. |
| tscon | tscon [-action <list|hijack|disconnect|logoff>] [-session_id <id>] | (Windows only) RDP session management — list, hijack, disconnect, or logoff sessions. Session takeover without credentials (T1563.002). |
| ts | ts [-a] [-i PID] | (Windows only) List threads in processes. By default shows only alertable threads (Suspended/DelayExecution). Use -a for all threads, -i to filter by PID (T1057). |
| uac-bypass | uac-bypass [-technique fodhelper|computerdefaults|sdclt|eventvwr|silentcleanup|cmstp|dismhost|wusa] [-command <path>] | (Windows only) Bypass UAC to escalate from medium to high integrity. 8 techniques: registry hijack, env var hijack, INF file abuse, COM CLSID hijack, mock trusted directory. Default spawns elevated callback (T1548.002, T1218.003). |
| uniq | uniq -path <file> [-count true] [-duplicate true] [-unique_only true] | Filter or count duplicate consecutive lines in a file. Count mode sorts by frequency. Cross-platform (T1083). |
| unlink | unlink -connection_id <uuid> | Disconnect a linked P2P agent (TCP or named pipe). Cross-platform (T1572). |
| uptime | uptime | Show system uptime, boot time, and load averages. Cross-platform (T1082). |
| upload | upload | Upload a file to the target with chunked file transfer. Supports auto-decompression of gzip files. SHA256 hash verification. |
| usn-jrnl | usn-jrnl -action query|recent|delete [-volume C:] | (Windows only) Query or delete NTFS USN Change Journal — destroys file operation history for anti-forensics (T1070.004). |
| vanilla-injection | vanilla-injection -action <inject|migrate|ldpreload> -pid <PID> | Inject shellcode into a remote process (inject), migrate agent (migrate: inject + exit), or spawn new process with LD_PRELOAD .so (ldpreload: Linux-only, no ptrace, bypasses Yama). Windows: VirtualAllocEx/WriteProcessMemory/CreateRemoteThread. Linux (amd64/arm64): /proc/PID/mem direct write, LD_PRELOAD via memfd. T1055.001, T1055.009, T1574.006. |
| vm-detect | vm-detect [-action detect|sandbox] | Detect VM/hypervisor environment or analyze sandbox evasion. detect: MAC OUI, DMI/SMBIOS, VM tools, SCSI, CPU hypervisor flag. sandbox: scored analysis — CPU count, RAM, disk, uptime, sleep timing, hostname, process count, username. Cross-platform (T1497, T1497.001). |
| vss | vss -action <list|create|delete|delete-all|extract|inhibit-recovery|shutdown|reboot> [-volume C:\\] [-id <id>] [-confirm true] | Impact techniques: VSS management (Windows), recovery inhibition (T1490), shutdown/reboot (T1529, cross-platform). Destructive actions require -confirm true. MITRE T1003.003, T1490, T1529. |
| watch-dir | watch-dir -path <dir> [-interval 5] [-duration 300] [-depth 3] [-pattern *.docx] [-hash true] | Monitor a directory for file system changes — detects new, modified, and deleted files via polling. Supports glob filtering and MD5 hash detection. Cross-platform (T1083, T1119). |
| wc | wc -path <file_or_dir> [-pattern <glob>] | Count lines, words, characters, and bytes in files. Directory mode with glob pattern filtering and totals. Cross-platform (T1083). |
| wdigest | wdigest -action <status|enable|disable> | (Windows only) Manage WDigest plaintext credential caching. Enable to capture cleartext passwords at next logon. MITRE T1003.001, T1112. |
| winrm | winrm -host <target> -username <user> [-password <pass>] [-hash <NT hash>] -command <cmd> [-shell cmd|powershell] [-auto-verify] or winrm -action check -host <target> [-username <user> -password <pass>] | Execute commands on remote Windows hosts via WinRM with NTLM authentication. Supports pass-the-hash, cmd.exe and PowerShell. check validates WinRM prerequisites (ports 5985/5986, auth, shell). Cross-platform (T1021.006, T1550.002). |
| windows | windows [-action list|search] [-filter <string>] [-all] | (Windows only) Enumerate visible application windows — shows HWND, PID, process name, window class, and title. Search filters by title/process/class. MITRE T1010. |
| who | who [-all true] | Show currently logged-in users and active sessions. Linux: parses utmp. Windows: WTS API. macOS: who command. Cross-platform (T1033). |
| whoami | whoami | Display current user identity and security context. Windows: username, SID, token type, integrity level, group memberships, privileges. Linux: user, UID, GID, groups, effective capabilities (decoded), SELinux/AppArmor context, container detection. macOS: user, UID, GID, groups. |
| wmi | wmi -action <execute|query|process-list|os-info|upload|exec-staged|check> [-target <host>] [-command <cmd>] [-query <wql>] | (Windows only) Execute WMI queries, process creation, file upload, and staged execution via COM API. upload: transfer files via certutil/PowerShell staging. exec-staged: upload then execute with auto-cleanup. check validates WMI prerequisites (RPC 135, WMI connectivity). MITRE T1047, T1570. |
| wmi-persist | wmi-persist -action <install|remove|list> -name <id> -trigger <logon|startup|interval|process> -command <exe> [-consumer_type <command|script>] | (Windows only) WMI Event Subscription persistence via COM API. Supports CommandLine and ActiveScript (VBScript/JScript) consumers. Fileless, survives reboots. MITRE T1546.003. |
| wlan-profiles | wlan-profiles [-name <SSID>] | Recover saved WiFi network profiles and credentials. Windows: WLAN API, Linux: NetworkManager/wpa_supplicant/iwd, macOS: Keychain. Cross-platform (T1555). |
| write-file | write-file [-action write|deface] -path <file> -content <text> [-base64 true] [-append true] [-mkdir true] [-confirm DEFACE] | Write content to files, or deface web pages. write: create/overwrite/append (default). deface: replace web content with defacement message (T1491, safety gate). Cross-platform (T1105, T1491). |
| write-memory | write-memory <dll_name> <function_name> <start_index> <hex_bytes> | (Windows only) Write bytes to a DLL function address. |
| xattr | xattr -action <list|get|set|delete> -path <file> [-name <attr>] [-value <data>] [-hex true] | (Linux/macOS only) Manage extended file attributes — list, get, set, delete. Unix complement to Windows ADS for data hiding (T1564.004). |
| Type |
|---|
| Executes Via |
|---|
| Examples |
|---|
| SharpCollection | .NET assemblies | inline-assembly | Seatbelt, SharpUp, Rubeus, Certify, SharpHound, SharpDPAPI |
| Sliver Armory | BOF/COFF files | inline-execute | SA-whoami, SA-adcs-enum, SA-ldapsearch, SA-nanodump |
| Source | Type | What it provides |
|---|
| Rubeus | .NET assembly | Kerberos attacks (kerberoasting, ticket forging, delegation) |
| Seatbelt | .NET assembly | Host security survey (privileges, credentials, configs) |
| Certify | .NET assembly | AD Certificate Services enumeration and abuse |
| SharpHound | .NET assembly | BloodHound data collection |
| SharpUp | .NET assembly | Local privilege escalation checks |
| SharpView | .NET assembly | Active Directory enumeration (PowerView port) |
| nanodump | BOF | LSASS memory dumping via MiniDumpWriteDump |
| credman | BOF | Windows Credential Manager harvesting |
| Variant | Technique | Trigger | Go Shellcode |
|---|
| 1 | Worker Factory Start Routine Overwrite | New worker thread creation | No |
| 2 | TP_WORK Insertion | Task queue processing | Yes |
| 3 | TP_WAIT Insertion | Event signaling | Yes |
| 4 | TP_IO Insertion | File I/O completion | Yes |
| 5 | TP_ALPC Insertion | ALPC port messaging | Yes |
| 6 | TP_JOB Insertion | Job object assignment | Yes |
| 7 | TP_DIRECT Insertion | I/O completion port | Yes |
| 8 | TP_TIMER Insertion | Timer expiration | Yes |
| Setting | Exports | Use Case |
|---|
standard (default) | Run, Fire, VoidFunc | sRDI shellcode, rundll32, generic loaders |
full | Standard + DllRegisterServer, DllUnregisterServer, ServiceMain, DllGetClassObject, DllCanUnloadNow | regsvr32, svchost service, COM hijack |
| Export | Execution | MITRE |
|---|
DllRegisterServer | regsvr32 /s fawkes.dll | T1218.010 |
DllUnregisterServer | regsvr32 /u /s fawkes.dll | T1218.010 |
ServiceMain | svchost.exe DLL service (Windows only) | T1543.003 |
DllGetClassObject + DllCanUnloadNow | COM hijack InprocServer32 | T1546.015 |
| inflate_count | Single byte (e.g. 0x90) | Two bytes (e.g. 0x41,0x42) |
|---|
| 1,000 | 1 KB | 2 KB |
| 10,000 | 10 KB | 20 KB |
| 100,000 | 100 KB | 200 KB |
| 1,000,000 | 1 MB | 2 MB |
| 3,000,000 | 3 MB | 6 MB |
| 10,000,000 | 10 MB | 20 MB |
| Parameter | Type | Description |
|---|
pe_preset | Choose | Quick impersonation preset (notepad, svchost, cmd, explorer, etc.) |
pe_company | String | CompanyName (e.g. "Microsoft Corporation") |
pe_description | String | FileDescription — visible in Task Manager |
pe_product | String | ProductName |
pe_version | String | File/Product version (e.g. "10.0.19041.1") |
pe_copyright | String | LegalCopyright |
pe_original_filename | String | OriginalFilename — visible to forensic tools |
pe_icon | File | Custom .ico or .png icon file |
pe_manifest | Choose | UAC level: asInvoker, highestAvailable, requireAdministrator |
| Type | Commands |
|---|
| Process Create | run, powershell, spawn, argue |
| API Call | net-enum, net-user, service, wmi, schtask, procdump, hashdump, eventlog, ntdll-unhook, syscalls, firewall, dcom, vss (create/delete), psexec |
| Process Kill | kill |
| Process Inject | vanilla-injection, apc-injection, threadless-inject, poolparty-injection, opus-injection, module-stomp, thread-hijack |
| File Write | upload, cp, mv |
| File Create | mkdir |
| File Delete | rm |
| File Modify | timestomp |
| Registry Write | reg (write/delete), remote-reg (set/delete), persist (registry, com-hijack, screensaver methods), uac-bypass, defender (add/remove-exclusion) |
| Registry Save | reg (save/creds) |
| Remote Registry | remote-reg (query/enum/set/delete via WinReg RPC) |
| Remote Service | remote-service (list/query/create/start/stop/delete/modify-path/trigger/dll-sideload via SVCCTL RPC) |
| Logon | make-token |
| Token Steal | steal-token, getsystem |
| Command | Credential Type | What's Reported |
|---|
| hashdump | hash | SAM NTLM hashes (Windows), MSV1_0 NT/LM/SHA hashes from in-situ LSASS walk (Windows, insitu-full), Kerberos TGTs and service tickets in .kirbi format (Windows, tickets), /etc/shadow hashes (Linux), PBKDF2 hashes (macOS) |
| kerberoast | hash | TGS tickets for offline cracking |
| asrep-roast | hash | AS-REP hashes |
| dcsync | hash | NTLM + AES keys via DRSGetNCChanges |
| lsa-secrets | plaintext/hash/key | Service passwords, cached creds, DPAPI keys |
| laps | plaintext | LAPS v1 & v2 passwords |
| gpp-password | plaintext | GPP encrypted passwords from SYSVOL |
| browser | plaintext | Chrome/Edge/Firefox saved passwords (all platforms), cookies (all platforms), history, autofill, bookmarks |
| dpapi | plaintext/hash | DPAPI-protected secrets |
| credman | plaintext | Credential Manager entries (on dump action) |
| make-token | plaintext | Credentials used for token creation |
| cred-harvest | hash/plaintext/token | Shadow hashes, cloud env vars, sensitive env vars, M365 OAuth/JWT tokens, live browser cookies/storage via CDP |
| credential-prompt | plaintext | Dialog-captured credentials (macOS/Windows/Linux) |
| Fingerprint | Description |
|---|
chrome | Chrome/Chromium (default) — most common browser, best for blending |
firefox | Firefox |
safari | Safari |
edge | Microsoft Edge |
rotate | Randomly selects Chrome/Firefox/Safari/Edge per-connection (prevents JA3 correlation) |
random | Fully randomized fingerprint (not browser-matching) |
go | No spoofing — use Go's default TLS stack |
| Parameter | Type | Description |
|---|
env_key_hostname | Regex | Hostname must match (e.g., WORKSTATION-\d+ or .*\.contoso\.com) |
env_key_domain | Regex | Domain must match (e.g., CONTOSO or .*\.local) |
env_key_username | Regex | Username must match (e.g., admin.* or svc_.*) |
env_key_process | String | Process name that must be running (e.g., outlook.exe) |
env_key_cpuid | Regex | CPU brand string must match (e.g., .*Intel.*i7-12700.* or .*AMD.*5950X.*). Prevents execution in sandboxes with different CPU models. |
env_key_derive | Choice | Encrypt C2 config with key derived from target host properties. Options: hostname, domain, username, hostname+domain, hostname+domain+username. Wrong host = AES decrypt fails = silent exit. Stronger than regex match — config values never appear in binary. |
chrome, firefox, safari, edge, rotate, random).key_rotation_interval). Derives fresh AES-256 keys via HKDF-SHA256, zeroes old keys. Limits blast radius of key compromise.host_header to override the HTTP Host header.fallback_hosts for resilient C2.Address and port for the child to listen on (e.g., 0.0.0.0:7777) |
| (empty = HTTP mode) |
namedpipe_bind_name | Named pipe name for the child to listen on (e.g., msrpc-f9a1). Windows only. | (empty) |
| Parameter | Type | Description | Default |
|---|
discord_token | String | Discord bot token for API authentication | (required) |
bot_channel | String | Discord channel ID for message exchange | (required) |
callback_interval | String | Seconds between tasking polls | 10 |
callback_jitter | String | Jitter percentage (0-100) | 23 |
message_checks | String | Max polling attempts per exchange | 20 |
time_between_checks | String | Seconds between poll attempts | 5 |
AESPSK | String | Pre-shared AES-256 encryption key | (auto-generated) |