Bof and assemblies completed

documentation-payload/Cazalla/opsec.md

@@ -78,7 +78,6 @@ These commands are **highly detectable** and require careful consideration:
 | Command | Risk Level | Detection Likelihood | Alternatives |
 |---------|-----------|---------------------|--------------|
 | `shell` | HIGH | High (cmd.exe spawn) | Use built-in Cazalla commands when possible |
-| `execute_assembly` | HIGH | High (process injection, Donut shellcode) | `inline_execute_assembly` for in-process execution |
 | `steal_token` | HIGH | High (EDR/XDR monitoring) | `make_token` when credentials available |
 | `rm` (system files) | HIGH | Blocked for safety | Never delete system files |
 | `screenshot` | HIGH | Screen capture detection | Use sparingly, consider timing |
@@ -90,7 +89,7 @@ These commands have **moderate detection risk**:
 | Command | Risk Level | Detection Likelihood | Notes |
 |---------|-----------|---------------------|-------|
 | `inline_execute` | MEDIUM | Memory allocation, API calls | In-process execution reduces some detection vectors |
-| `inline_execute_assembly` | MEDIUM | CLR loading, memory allocation | Better OPSEC than `execute_assembly` (no process injection) |
+| `inline_execute_assembly` | MEDIUM | CLR loading, memory allocation | In-process execution (no process injection) |
 | `download` | MEDIUM | File access logging | Large files may trigger DLP |
 | `upload` | MEDIUM | File write detection | Suspicious extensions monitored |
 | `socks` | MEDIUM | Network traffic analysis | High bandwidth usage |
@@ -118,7 +117,6 @@ These commands have **low detection risk**:
 **Endpoint Detection and Response (EDR)** and **Extended Detection and Response (XDR)** solutions monitor:
 
 - **Process Creation**: `shell` command spawns `cmd.exe` (highly monitored)
-- **Process Injection**: `execute_assembly` uses Donut shellcode injection (heavily monitored)
 - **Memory Allocation**: `inline_execute` and `inline_execute_assembly` allocate executable memory (may be scanned)
 - **CLR Loading**: Loading .NET assemblies into memory may trigger EDR detections
 - **Token Manipulation**: `steal_token` and `make_token` generate authentication events
@@ -128,7 +126,7 @@ These commands have **low detection risk**:
 
 **Mitigation Strategies:**
 - Use built-in Cazalla commands instead of `shell` when possible
-- Prefer `inline_execute_assembly` over `execute_assembly` for better OPSEC (in-process vs process injection)
+- Use `inline_execute_assembly` for .NET assembly execution (in-process, no process injection)
 - Use `inline_execute` for BOFs when possible (no process creation)
 - Prefer `make_token` over `steal_token` when credentials are available
 - Avoid accessing LSASS or other critical system processes
@@ -339,12 +337,7 @@ Built-in Cazalla commands:
 #### `inline_execute_assembly`
 - **Risk**: MEDIUM
 - **Detection**: CLR loading, memory allocation, AMSI/ETW bypass attempts may trigger behavioral detections
-- **Best Practice**: Better OPSEC than `execute_assembly` (no process injection). Use `--amsi` and `--etw` flags when needed, but be aware they may be detected.
-
-#### `execute_assembly`
-- **Risk**: HIGH
-- **Detection**: Process injection (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), Donut shellcode patterns, memory scanning
-- **Best Practice**: Use only when necessary. Prefer `inline_execute_assembly` for better OPSEC. High detection risk due to process injection techniques.
+- **Best Practice**: In-process execution (no process injection). Use `--amsi` and `--etw` flags when needed, but be aware they may be detected.
 
 #### `rev2self`
 - **Risk**: LOW