waitForOutput waits for task output

fireAndForget is used for commands known to never produce output from the beacon. The API accepted the command and returned a task ID, so we just retu

logInfo logs an info message

Info logs an info message

logDebug logs a debug message

Error logs an error message

executeAddListener is a generic handler for all add_*_listener action types. It passes the entire parameters map to the corresponding csrest method.

executeUpdateListener is a generic handler for all update_*_listener action types.

truncate truncates a string to a maximum length

log writes a log message at the specified level

checkAllOf checks if all conditions are true (AND logic)

logError logs an error message

executeActions executes a list of actions

recordResult records an action result

validateCondition validates a condition

NewFormatter creates a new output formatter

PackBOFArguments packs typed arguments into binary format for BOF execution Format verified against Cobalt Strike 4.x bof_pack() implementation Key f

Warn logs a warning message

WorkflowRequiresBeacon checks if any action in the workflow requires a beacon.

checkAnyOf checks if at least one condition is true (OR logic)

evaluateActionConditions evaluates all condition groups for an action

evaluateCondition evaluates a single condition (supports nested any_of/all_of)

executeAction executes a single action

executeConsoleCommand executes a console command on the beacon

filterBeacons applies filter criteria to beacon list

formatTimeAgo formats a duration into a human-readable "time ago" string

storeWorkflowVariables stores user-defined variables in outputs map for interpolation

ActionRequiresBeacon returns true if the action type requires a beacon ID. Server-level operations (listeners, payloads, config) return false. The spe

Debug logs a debug message

DisplayBeaconDetails shows detailed information about a selected beacon

Execute runs a workflow

GetResults returns the action results

ListBeacons displays a non-interactive table of beacons and exits

LoadConfig loads configuration from file with environment variable overrides

LoadWorkflow loads a workflow from a YAML file

New creates a new logger

NewExecutor creates a new workflow executor

NewValidator creates a new workflow validator

SelectBeacon displays an interactive table of beacons and lets the user select one

SelectBeaconWithFilter displays filtered beacons and lets the user select one

SetLogger sets the logger for the executor

SetTaskTimeout sets the timeout for task completion

Validate checks if required configuration is present

Validate performs pre-flight validation of a workflow

WriteResult writes a result in the configured format

actionsRequireBeacon recursively checks actions and their nested actions.

checkCondition checks a single condition

executeActionsParallel executes actions in parallel

executeBOFPack executes a BOF with typed arguments

executeBOFPackCustom executes a BOF with custom packed arguments

executeBOFPacked executes a BOF with packed arguments

executeBOFString executes a BOF with string arguments

============================================================ Beacon Configuration Action Handlers ====================================================

executeBrowserPivotStart starts a browser pivot into the specified process

executeBrowserPivotStop tears down the browser pivoting sessions associated with this beacon

--- Download Management Handlers --- executeCancelDownload cancels an active file download on the beacon

--- File & Directory Operation Handlers --- executeCd changes the beacon's working directory

executeCheckin forces a DNS beacon to check in immediately

executeChromeDump recovers credential material from Google Chrome

executeClearQueue clears the command queue for the specified beacon

executeClipboard gets clipboard contents from the beacon

executeCp copies a file

executeDcSync extracts NTLM password hash for domain users

============================================================ Beacon Management Action Handlers =======================================================

executeDeleteListener removes a listener by name

executeDisableBeaconGate disables beacon gate for the specified beacon

executeDisableBlockDlls disables block DLLs for the specified beacon

executeDownload downloads a file from the beacon

executeDownloadPayload downloads a previously generated payload

executeDrives lists drives

executeElevateBeacon creates an elevated beacon session

--- Privilege Elevation --- executeElevateCommand executes a command in elevated context

executeEnableBeaconGate enables beacon gate for the specified beacon

executeEnableBlockDlls enables block DLLs for the specified beacon

executeExecuteAssembly executes a .NET assembly

executeExit tells the beacon to exit

executeGenerateStagelessPayload generates a stageless beacon payload

executeGenerateStagerPayload generates a stager beacon payload

executeGetC2Profile retrieves the Malleable C2 profile

--- Server Config Operations --- executeGetKillDate retrieves the beacon kill date

executeGetListener retrieves a specific listener by name

executeGetPrivs enables all available privileges

executeGetSystem executes getsystem command

executeGetSystemInfo retrieves team server system information

executeGetTeamserverIp retrieves the team server IP

executeGetUID executes getuid command

executeHashdump dumps password hashes

executeInjectBeacon injects beacon shellcode into a process

--- DLL Operations --- executeInjectDll injects a reflective DLL into a process

executeInjectLoadDll loads a DLL from disk via LoadLibrary

executeInjectPostExDll injects postex DLL into a process

executeInjectPth injects into a process for pass-the-hash

executeInjectShellcode injects shellcode into a process

executeJobStop stops an active job

executeJump executes a beacon session on a remote target with the specified remote execution method

executeKerberosTicketPurge purges Kerberos tickets from the session

executeKerberosTicketUse applies a Kerberos ticket to the session

--- Capture Operation Handlers --- executeKeylogger starts a keylogger on the beacon (long-running background job)

executeKill terminates a process by PID