# upload - Upload File to Target

Upload a file from the Mythic server to the target system.

## Description

The `upload` command uploads a file from the Mythic server to the target system. Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written.

## Syntax

```
upload <file_id> <destination_path>
```

## Parameters

- `file_id` (required): File ID from Mythic's file browser. Obtained by uploading a file to Mythic first.
- `destination_path` (required): Destination path where the file will be written. Supports both absolute and relative paths.

## Examples

```
upload abc123-def456-ghi789 C:\Users\Administrator\Desktop\payload.exe
upload xyz789 C:\Windows\Temp\stager.dll
upload file123 C:\temp\data.txt
```

## Features

- Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
- Creates a 'File Write' artifact for tracking
- Uploads to sensitive locations (System32, Windows, Program Files) or with suspicious extensions (.exe, .dll, .ps1, .bat, .vbs) may trigger detection by security tools

## Output

```
[upload] Starting upload: C:\Users\Administrator\Desktop\payload.exe (2048000 bytes)
[upload] Chunk 1/4 written: 512000 bytes
[upload] Chunk 2/4 written: 512000 bytes
[upload] Chunk 3/4 written: 512000 bytes
[upload] Chunk 4/4 written: 512000 bytes
[upload] Upload complete: C:\Users\Administrator\Desktop\payload.exe
```

## OPSEC Considerations

- File writes are logged by EDR/XDR solutions
- Uploads to sensitive locations may trigger alerts
- Suspicious file extensions (.exe, .dll, .ps1, .bat, .vbs) are monitored
- File write artifacts are automatically tracked

## Related

[File Uploads Support](../../../features.md#file-uploads-support)

---

**Command Category:** File System  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)
