Bof and assemblies completed

documentation-payload/Cazalla/commands/inline_execute_assembly.md

@@ -45,32 +45,40 @@ inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit
 
 ## How It Works
 
-1. The command creates a subtask that calls `inline_execute` with the Inline-EA BOF
-2. The .NET assembly is passed to the BOF as raw bytes
-3. The BOF loads the assembly into memory using .NET CLR APIs
-4. Optional bypasses (AMSI, ETW) are applied if requested
-5. The assembly's entry point is executed with the provided arguments
-6. Output is captured and returned to Mythic
+1. The command retrieves the .NET assembly from Mythic
+2. The command searches for the Inline-EA BOF (`inline-ea.x64.o`) in Mythic's file store
+3. A subtask is created that calls `inline_execute` with the Inline-EA BOF
+4. The .NET assembly is passed to the BOF as raw bytes (hex-encoded)
+5. The BOF loads the assembly into memory using .NET CLR APIs
+6. Optional bypasses (AMSI, ETW) are applied if requested via flags
+7. The assembly's entry point is executed with the provided arguments
+8. Output is captured via `BeaconPrintf` and returned to the parent task through a completion callback
+9. The completion callback aggregates the output and displays it in the main command
 
 ## Output
 
+The command returns the output from the .NET assembly execution:
+
 ```
-[inline_execute_assembly] Assembly execution requested
-[BOF Output from Inline-EA]
 SharpUp execution started...
 [*] Checking for insecure file permissions...
 [*] Checking for unquoted service paths...
 [+] Found: C:\Program Files\Vulnerable Service\service.exe
+[*] Completed Privesc Checks in 17 seconds
 ```
 
+The output is captured from the Inline-EA BOF execution and displayed directly in the main command (not as a subtask).
+
 ## OPSEC Considerations
 
-- **Process Create Artifact**: Assembly execution creates a "Process Create" artifact
+- **MEDIUM OPSEC RISK**: In-process execution provides better OPSEC than process spawning (no process injection)
+- **Process Create Artifact**: Assembly execution creates a "Process Create" artifact that is logged in Mythic
 - **CLR Loading**: Loading .NET assemblies into memory may be detected by EDR solutions
-- **AMSI Bypass**: Patching clr.dll for AMSI bypass may trigger behavioral detections
-- **ETW Bypass**: EAT hooking may be detected by advanced EDR solutions
-- **No New Process**: Executes in-process, reducing some detection vectors compared to `execute_assembly`
-- **Memory Allocation**: Allocates executable memory for the assembly, which may be scanned
+- **AMSI Bypass**: Patching `clr.dll` for AMSI bypass may trigger behavioral detections (more evasive than patching `amsi.dll`)
+- **ETW Bypass**: EAT hooking `advapi32.dll!EventWrite` may be detected by advanced EDR solutions
+- **No New Process**: Executes in-process, reducing some detection vectors compared to process spawning
+- **Memory Allocation**: Allocates executable memory for the assembly, which may be scanned by EDR
+- **Thread Isolation**: BOF execution runs in a separate thread with timeout protection
 
 ## Technical Details
 
@@ -84,22 +92,25 @@ This command uses the Inline-EA BOF developed by @EricEsquivel:
 
 ### Bypass Options
 
-- **--patchexit**: Patches `System.Environment.Exit` to prevent the assembly from terminating the agent process
-- **--amsi**: Bypasses AMSI by patching `clr.dll` instead of `amsi.dll` (more evasive)
-- **--etw**: Bypasses ETW by hooking `advapi32.dll!EventWrite` via Export Address Table (EAT) hooking
+- **--patchexit**: Patches `System.Environment.Exit` to prevent the assembly from terminating the agent process. Default: `false`
+- **--amsi**: Bypasses AMSI by patching `clr.dll` instead of `amsi.dll` (more evasive than traditional AMSI bypasses). Default: `false`
+- **--etw**: Bypasses ETW by hooking `advapi32.dll!EventWrite` via Export Address Table (EAT) hooking. Default: `false`
+
+**Note**: Boolean flags (`--amsi`, `--etw`, `--patchexit`) are automatically converted to integers (0 or 1) for the BOF.
 
 ## Error Handling
 
 The command handles various error scenarios:
 - **Assembly Not Found**: Returns error if assembly file cannot be retrieved from Mythic
+- **BOF Not Found**: Returns error if Inline-EA BOF (`inline-ea.x64.o`) is not found in Mythic's file store
 - **BOF Execution Failure**: Returns error if Inline-EA BOF cannot be executed
 - **Assembly Load Failure**: Returns error if .NET assembly cannot be loaded
 - **Bypass Failure**: May fail silently if bypasses cannot be applied
+- **Timeout**: If BOF execution hangs, it will timeout after 30 seconds and output will still be captured
 
 ## Related
 
 - [`inline_execute`](inline_execute.md) - Execute BOFs directly
-- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
 - [Artifacts Support](../features.md#artifacts-support)
 
 ---