Bof Loader implemented

documentation-payload/Cazalla/opsec.md

@@ -78,6 +78,7 @@ These commands are **highly detectable** and require careful consideration:
 | Command | Risk Level | Detection Likelihood | Alternatives |
 |---------|-----------|---------------------|--------------|
 | `shell` | HIGH | High (cmd.exe spawn) | Use built-in Cazalla commands when possible |
+| `execute_assembly` | HIGH | High (process injection, Donut shellcode) | `inline_execute_assembly` for in-process execution |
 | `steal_token` | HIGH | High (EDR/XDR monitoring) | `make_token` when credentials available |
 | `rm` (system files) | HIGH | Blocked for safety | Never delete system files |
 | `screenshot` | HIGH | Screen capture detection | Use sparingly, consider timing |
@@ -88,6 +89,8 @@ These commands have **moderate detection risk**:
 
 | Command | Risk Level | Detection Likelihood | Notes |
 |---------|-----------|---------------------|-------|
+| `inline_execute` | MEDIUM | Memory allocation, API calls | In-process execution reduces some detection vectors |
+| `inline_execute_assembly` | MEDIUM | CLR loading, memory allocation | Better OPSEC than `execute_assembly` (no process injection) |
 | `download` | MEDIUM | File access logging | Large files may trigger DLP |
 | `upload` | MEDIUM | File write detection | Suspicious extensions monitored |
 | `socks` | MEDIUM | Network traffic analysis | High bandwidth usage |
@@ -115,6 +118,9 @@ These commands have **low detection risk**:
 **Endpoint Detection and Response (EDR)** and **Extended Detection and Response (XDR)** solutions monitor:
 
 - **Process Creation**: `shell` command spawns `cmd.exe` (highly monitored)
+- **Process Injection**: `execute_assembly` uses Donut shellcode injection (heavily monitored)
+- **Memory Allocation**: `inline_execute` and `inline_execute_assembly` allocate executable memory (may be scanned)
+- **CLR Loading**: Loading .NET assemblies into memory may trigger EDR detections
 - **Token Manipulation**: `steal_token` and `make_token` generate authentication events
 - **Memory Access**: Accessing LSASS memory triggers high-priority alerts
 - **API Hooking**: Keyloggers and screen capture use monitored APIs
@@ -122,6 +128,8 @@ These commands have **low detection risk**:
 
 **Mitigation Strategies:**
 - Use built-in Cazalla commands instead of `shell` when possible
+- Prefer `inline_execute_assembly` over `execute_assembly` for better OPSEC (in-process vs process injection)
+- Use `inline_execute` for BOFs when possible (no process creation)
 - Prefer `make_token` over `steal_token` when credentials are available
 - Avoid accessing LSASS or other critical system processes
 - Use keylogging only when absolutely necessary
@@ -321,6 +329,23 @@ Built-in Cazalla commands:
 - **Detection**: Authentication event logging
 - **Best Practice**: Less detectable than `steal_token`, use when credentials available
 
+### Code Execution Commands
+
+#### `inline_execute`
+- **Risk**: MEDIUM
+- **Detection**: Memory allocation (executable pages), API calls (LoadLibraryA, GetProcAddress), symbol resolution
+- **Best Practice**: In-process execution reduces detection vectors compared to process spawning. Use for lightweight operations.
+
+#### `inline_execute_assembly`
+- **Risk**: MEDIUM
+- **Detection**: CLR loading, memory allocation, AMSI/ETW bypass attempts may trigger behavioral detections
+- **Best Practice**: Better OPSEC than `execute_assembly` (no process injection). Use `--amsi` and `--etw` flags when needed, but be aware they may be detected.
+
+#### `execute_assembly`
+- **Risk**: HIGH
+- **Detection**: Process injection (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), Donut shellcode patterns, memory scanning
+- **Best Practice**: Use only when necessary. Prefer `inline_execute_assembly` for better OPSEC. High detection risk due to process injection techniques.
+
 #### `rev2self`
 - **Risk**: LOW
 - **Detection**: Minimal