Angerona/documentation-payload/Cazalla/commands.md

+++ 
title = "Commands" 
chapter = false 
weight = 10 
pre = "4. " 
+++

# Cazalla Command Reference

Complete documentation for all Cazalla agent commands.

## 📋 Table of Contents

- [File System Commands](#file-system-commands)
- [Process Management Commands](#process-management-commands)
- [Token Operations](#token-operations)
- [Network Tunneling](#network-tunneling)
- [System Operations](#system-operations)
- [Control Commands](#control-commands)

---

## File System Commands

### `ls` - List Directory Contents

List directory contents with detailed file information.

**Syntax:**
```
ls [path]
```

**Parameters:**
- `path` (optional): Directory path to list. If omitted, lists current working directory.

**Examples:**
```
ls
ls C:\Users
ls C:\Windows\*.exe
```

**Features:**
- Supports wildcards (e.g., `*.exe`, `*.txt`)
- Displays file type (File/Directory), size, modification date, and name
- Compatible with Mythic File Browser for interactive file management
- Relative paths are resolved using current working directory

**Output Format:**
```
Type      Size        Modified              Name
------    ----------  -------------------   --------------------
File      1024       2024-01-15 10:30:00    file.txt
Directory 0          2024-01-15 09:00:00   Documents
```

**Related:** [File Browser Integration](features.md#file-browser-integration)

---

### `cd` - Change Directory

Change the current working directory for the agent.

**Syntax:**
```
cd <path>
```

**Parameters:**
- `path` (required): Directory path to change to. Supports both absolute and relative paths.

**Examples:**
```
cd C:\Users\Administrator
cd ..
cd Documents
```

**Features:**
- The new directory is automatically tracked and displayed in the Mythic UI context tabs
- Supports both absolute paths (e.g., `C:\Windows\System32`) and relative paths
- The current directory is used by other file system commands when relative paths are provided

**Output:**
```
Changed directory to: C:\Users\Administrator
```

**Related:** [Context Tracking](features.md#context-tracking)

---

### `pwd` - Print Working Directory

Display the current working directory of the agent.

**Syntax:**
```
pwd
```

**Parameters:** None

**Examples:**
```
pwd
```

**Output:**
```
C:\Users\Administrator\Documents
```

**Features:**
- Shows the absolute path that the agent is currently using as its working directory
- This directory is automatically tracked and displayed in the Mythic UI context tabs
- Useful for verifying the current location before executing file system operations

**Related:** [Context Tracking](features.md#context-tracking)

---

### `cat` - Read File Contents

Read and display the contents of a file on the target system.

**Syntax:**
```
cat <file_path>
```

**Parameters:**
- `file_path` (required): Path to the file to read. Supports both absolute and relative paths.

**Examples:**
```
cat C:\Users\Administrator\Desktop\notes.txt
cat config.ini
cat C:\Windows\System32\drivers\etc\hosts
```

**Features:**
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
- Automatically detects and extracts credentials from file contents including:
  - Plaintext passwords
  - NTLM hashes (format: `aad3b435b51404ee:hash`)
  - Domain credentials
- Detected credentials are automatically added to Mythic's credential store
- Useful for reading configuration files, log files, and credential databases

**Output Example:**
```
[cat] Reading file: C:\Users\Administrator\notes.txt
Hello, this is a test file.

[cat] Credentials detected:
- Password: MyPassword123
- Hash: aad3b435b51404ee:1234567890abcdef...
```

**OPSEC Considerations:**
- File reads are logged by EDR/XDR solutions
- Accessing sensitive files (System32, Program Files) may trigger alerts
- Consider using `download` for large files instead of `cat`

**Related:** [Credentials Support](features.md#credentials-support)

---

### `cp` - Copy File

Copy a file from a source location to a destination path on the target system.

**Syntax:**
```
cp <source_path> <destination_path>
```

**Parameters:**
- `source_path` (required): Path to the source file
- `destination_path` (required): Path where the file will be copied to

**Examples:**
```
cp C:\Users\file.txt C:\temp\backup.txt
cp source.exe C:\Windows\Temp\malware.exe
cp config.ini config.ini.bak
```

**Features:**
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
- The destination file will be overwritten if it already exists
- Creates a 'File Write' artifact for the destination file
- Useful for creating backups, moving files, or preparing payloads in staging directories

**Output:**
```
[cp] File copied: C:\Users\file.txt -> C:\temp\backup.txt
```

**OPSEC Considerations:**
- File writes are logged by EDR/XDR solutions
- Copying to sensitive locations (System32, Windows, Program Files) may trigger alerts
- File write artifacts are automatically tracked

**Related:** [Artifacts Support](features.md#artifacts-support)

---

### `mkdir` - Create Directory

Create a new directory on the target system.

**Syntax:**
```
mkdir <path>
```

**Parameters:**
- `path` (required): Directory path to create. Supports both absolute and relative paths.

**Examples:**
```
mkdir C:\temp\new_folder
mkdir staging
mkdir C:\Users\Administrator\Documents\Project
```

**Features:**
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
- Creates parent directories if they don't exist
- Useful for creating staging directories, temporary folders, or organizing files during post-exploitation activities

**Output:**
```
[mkdir] Directory created: C:\temp\new_folder
```

---

### `rm` - Delete File or Directory

Delete a file or directory from the target system.

**Syntax:**
```
rm <path>
```

**Parameters:**
- `path` (required): File or directory path to delete. Supports both absolute and relative paths.

**Examples:**
```
rm C:\temp\file.txt
rm C:\temp\old_folder
rm backup.log
```

**Features:**
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
- Can delete individual files or entire directories
- WARNING: Deletion of critical system files or directories (System32, Windows, Program Files, etc.) will be blocked for safety
- Use with caution as deleted files cannot be recovered through this command

**Output:**
```
[rm] File deleted: C:\temp\file.txt
```

**OPSEC Considerations:**
- File deletions are logged by EDR/XDR solutions
- Deleting system files may trigger alerts
- Consider the operational impact before deleting files

---

### `download` - Download File from Target

Download a file from the target system to the Mythic server.

**Syntax:**
```
download <file_path>
```

**Parameters:**
- `file_path` (required): Path to the file to download. Supports both absolute and relative paths.

**Examples:**
```
download C:\Users\Administrator\Desktop\important.txt
download C:\Windows\System32\config\sam
download report.pdf
```

**Features:**
- Supports files up to 2GB in size
- Files are transferred in 512KB chunks for efficient transmission
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
- Compatible with Mythic File Browser for interactive file selection
- Large files or sensitive files may trigger detection by EDR/XDR solutions and data loss prevention (DLP) systems

**Output:**
```
[download] Starting download: C:\Users\important.txt (1024000 bytes)
[download] Chunk 1/2 downloaded: 512000 bytes
[download] Chunk 2/2 downloaded: 512000 bytes
[download] Download complete: C:\Users\important.txt
```

**OPSEC Considerations:**
- File reads are logged by EDR/XDR solutions
- Large downloads generate network traffic and may trigger alerts
- Downloading sensitive files (SAM, config files) may trigger DLP systems
- Consider using smaller chunk sizes or splitting large files

**Related:** [File Downloads Support](features.md#file-downloads-support)

---

### `upload` - Upload File to Target

Upload a file from the Mythic server to the target system.

**Syntax:**
```
upload <file_id> <destination_path>
```

**Parameters:**
- `file_id` (required): File ID from Mythic's file browser. Obtained by uploading a file to Mythic first.
- `destination_path` (required): Destination path where the file will be written. Supports both absolute and relative paths.

**Examples:**
```
upload abc123-def456-ghi789 C:\Users\Administrator\Desktop\payload.exe
upload xyz789 C:\Windows\Temp\stager.dll
upload file123 C:\temp\data.txt
```

**Features:**
- Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
- Creates a 'File Write' artifact for tracking
- Uploads to sensitive locations (System32, Windows, Program Files) or with suspicious extensions (.exe, .dll, .ps1, .bat, .vbs) may trigger detection by security tools

**How to Get File ID:**

1. Upload a file to Mythic:
   - Go to **Files** in Mythic UI
   - Click **Upload File**
   - Select your file
   - Note the file ID (shown in the file list)

2. Use the file ID in the upload command

**Output:**
```
[upload] Starting upload: C:\Users\Administrator\Desktop\payload.exe (2048000 bytes)
[upload] Chunk 1/4 written: 512000 bytes
[upload] Chunk 2/4 written: 512000 bytes
[upload] Chunk 3/4 written: 512000 bytes
[upload] Chunk 4/4 written: 512000 bytes
[upload] Upload complete: C:\Users\Administrator\Desktop\payload.exe
```

**OPSEC Considerations:**
- File writes are logged by EDR/XDR solutions
- Uploads to sensitive locations may trigger alerts
- Suspicious file extensions (.exe, .dll, .ps1, .bat, .vbs) are monitored
- File write artifacts are automatically tracked

**Related:** [File Uploads Support](features.md#file-uploads-support)

---

## Process Management Commands

### `ps` - List Processes

List all running processes on the target system.

**Syntax:**
```
ps
```

**Parameters:** None

**Examples:**
```
ps
```

**Features:**
- Displays detailed process information including:
  - PID (Process ID)
  - Process name
  - Parent PID
  - Architecture (x64/x86)
  - Username
  - Session ID
- Automatically updates the Mythic Process Browser, allowing interactive process management (kill, steal_token, list_tokens) directly from the UI
- The Process Browser cache is automatically cleared to show only currently running processes

**Output Format:**
```
PID     Process Name          PPID    Arch    User                    Session
-----   -------------------   -----   -----   ----------------------  -------
1234    explorer.exe          1230    x64     DESKTOP-ABC\User        1
5678    chrome.exe            1234    x64     DESKTOP-ABC\User        1
```

**Related:** [Process Browser Integration](features.md#process-browser-integration)

---

### `kill` - Terminate Process

Terminate a process by its Process ID (PID).

**Syntax:**
```
kill <pid>
```

**Parameters:**
- `pid` (required): Process ID of the process to terminate.

**Examples:**
```
kill 1234
kill 5678
```

**Features:**
- The process is immediately terminated using TerminateProcess API
- Compatible with Mythic Process Browser for interactive process termination
- Automatically removes the killed process from the Process Browser view
- WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination to prevent system instability
- Creates a 'Process Termination' artifact for tracking

**Output:**
```
[kill] Process terminated: explorer.exe (PID: 1234)
```

**OPSEC Considerations:**
- Process termination is logged by EDR/XDR solutions
- Terminating critical processes may trigger alerts
- Process termination artifacts are automatically tracked

**Related:** [Process Browser Integration](features.md#process-browser-integration), [Artifacts Support](features.md#artifacts-support)

---

## Token Operations

### `list_tokens` - Enumerate Tokens

Enumerate and list all available security tokens from running processes on the target system.

**Syntax:**
```
list_tokens
```

**Parameters:** None

**Examples:**
```
list_tokens
```

**Features:**
- Shows detailed token information including user context, privileges, and groups for each process
- Compatible with Mythic Process Browser for interactive token enumeration
- Useful for reconnaissance to identify high-value tokens before attempting token theft
- Lower detection risk than token theft operations, but token enumeration may still be logged by security tools

**Output Format:**
```
PID     Process Name          User                    Domain           Privileges
-----   -------------------   ----------------------  --------------   -------------------
1234    lsass.exe             SYSTEM                  NT AUTHORITY      SeDebugPrivilege
5678    explorer.exe          User                    DESKTOP-ABC      SeChangeNotifyPrivilege
```

**OPSEC Considerations:**
- Token enumeration may be logged by security tools
- Lower risk than token theft, but still detectable
- Use for reconnaissance before attempting token theft

**Related:** [Process Browser Integration](features.md#process-browser-integration), [Token Support](features.md#token-support)

---

### `steal_token` - Steal Process Token

Steal and impersonate the security token from a target process.

**Syntax:**
```
steal_token <pid>
```

**Parameters:**
- `pid` (required): Process ID of the process to steal the token from.

**Examples:**
```
steal_token 1234
steal_token 5678
```

**Features:**
- Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process
- Compatible with Mythic Process Browser for interactive token theft
- The impersonation context is automatically tracked and displayed in the Mythic UI
- CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions, especially when targeting LSASS or other critical processes
- Always requires approval from another operator
- Prefer `make_token` for domain credentials when possible

**Output:**
```
[steal_token] Token stolen from process: explorer.exe (PID: 1234)
[steal_token] Impersonating user: DESKTOP-ABC\User
```

**OPSEC Considerations:**
- **CRITICAL OPSEC RISK**: Token theft is heavily monitored
- Targeting LSASS or critical processes triggers high-priority alerts
- Always requires operator approval (OPSEC pre-check blocks execution)
- Process access is logged by EDR/XDR solutions
- Consider using `make_token` instead when you have credentials

**Related:** [OPSEC Checking](opsec.md), [Token Support](features.md#token-support), [Process Browser Integration](features.md#process-browser-integration)

---

### `make_token` - Create Token from Credentials

Create a new security token using plaintext credentials and impersonate it.

**Syntax:**
```
make_token <domain> <username> <password> [logon_type]
```

**Parameters:**
- `domain` (required): Domain name (or empty string for local machine)
- `username` (required): Username to authenticate as
- `password` (required): Password for authentication
- `logon_type` (optional): Logon type (default: 9 - NewCredentials)

**Examples:**
```
make_token "" Administrator P@ssw0rd123
make_token DOMAIN user01 MyPassword
make_token WORKGROUP localuser Secret123 9
```

**Features:**
- Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API
- The logon_type parameter (default: 9 - NewCredentials) determines the authentication type
- The impersonation context is automatically tracked and displayed in the Mythic UI
- Less detectable than `steal_token` as it doesn't require accessing LSASS memory, but may still generate authentication logs
- Use `rev2self` to revert to the original token

**Output:**
```
[make_token] Creating token for: DOMAIN\User01
[make_token] Authentication successful
[make_token] Impersonating user: DOMAIN\User01
```

**OPSEC Considerations:**
- Authentication events are logged by Windows Event Log
- Less detectable than token theft, but still generates logs
- Authentication failures may trigger alerts
- Use `rev2self` after completing operations to reduce detection risk

**Related:** [Token Support](features.md#token-support), [Context Tracking](features.md#context-tracking)

---

### `rev2self` - Revert Token Impersonation

Revert token impersonation back to the original process token.

**Syntax:**
```
rev2self
```

**Parameters:** None

**Examples:**
```
rev2self
```

**Features:**
- This command stops impersonating any stolen or created token and returns to the agent's original security context
- The impersonation context in the Mythic UI is automatically cleared
- Use this command after completing operations that required elevated privileges to return to a less-privileged context and reduce detection risk

**Output:**
```
[rev2self] Reverted to original token
[rev2self] Current user: DESKTOP-ABC\OriginalUser
```

**Related:** [Token Support](features.md#token-support), [Context Tracking](features.md#context-tracking)

---

### `whoami` - Display Current Context

Display the current security context of the agent.

**Syntax:**
```
whoami
```

**Parameters:** None

**Examples:**
```
whoami
```

**Features:**
- Shows the username and domain of the active security token
- If token impersonation is active (via `steal_token` or `make_token`), displays the impersonated user context
- Otherwise, displays the process token context
- Useful for verifying that token operations succeeded and for confirming the current privilege level before executing commands that require specific permissions

**Output:**
```
Current user: DOMAIN\User01
Domain: DOMAIN
```

**Related:** [Token Support](features.md#token-support), [Context Tracking](features.md#context-tracking)

---

## Network Tunneling

### `socks` - SOCKS5 Proxy

Start or stop a SOCKS5 proxy server on the Mythic server.

**Syntax:**
```
socks {"action":"start","port":7002}
socks {"action":"stop","port":7002}
```

**Parameters:**
- `action` (required): Either `"start"` or `"stop"`
- `port` (optional): Port number for the SOCKS proxy (default: 7002)

**Examples:**
```
socks {"action":"start","port":7002}
socks {"action":"stop","port":7002}
```

**Features:**
- When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources
- The default port is 7002
- The proxy runs on the Mythic server and uses the agent as a tunnel for network connections
- WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
- Use non-standard ports and be aware of high bandwidth usage

**Output:**
```
[socks] SOCKS proxy started on port 7002
```

**OPSEC Considerations:**
- SOCKS proxies generate continuous network traffic
- May be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
- Use non-standard ports
- Be aware of high bandwidth usage
- Consider the operational impact before starting

**Related:** [SOCKS Proxy Support](features.md#socks-proxy-support), [Usage Examples](examples.md#socks-proxy-example)

---

### `rpfwd` - Reverse Port Forwarding

Start or stop reverse port forwarding (RPFWD).

**Syntax:**
```
rpfwd {"action":"start","port":8080,"remote_host":"127.0.0.1","remote_port":80}
rpfwd {"action":"stop","port":8080}
```

**Parameters:**
- `action` (required): Either `"start"` or `"stop"`
- `port` (required for start): Local port on the agent to listen on (default: 8080)
- `remote_host` (required for start): Remote host to forward connections to
- `remote_port` (required for start): Remote port to forward connections to

**Examples:**
```
rpfwd {"action":"start","port":8080,"remote_host":"192.168.1.100","remote_port":80}
rpfwd {"action":"start","port":3306,"remote_host":"10.0.0.50","remote_port":3306}
rpfwd {"action":"stop","port":8080}
```

**Features:**
- When started, the agent listens on a local port on the target system
- Connections to this local port are forwarded through the agent to Mythic, which then connects to a remote destination (remote_host:remote_port)
- Default local port: 8080
- Useful for accessing services on the target network that are not directly reachable from Mythic (e.g., internal services, databases, management interfaces)
- WARNING: Reverse port forwarding creates persistent network connections and may be detected by network monitoring, firewall logging, NIDS, and EDR/XDR network monitoring
- Avoid using privileged ports (<1024) which require elevated privileges

**Output:**
```
[rpfwd] Reverse port forwarding started on port 8080
[rpfwd] Forwarding connections to: 192.168.1.100:80
```

**OPSEC Considerations:**
- Reverse port forwarding creates persistent network connections
- May be detected by network monitoring, firewall logging, NIDS, and EDR/XDR network monitoring
- Avoid using privileged ports (<1024) which require elevated privileges
- Consider the operational impact before starting

**Related:** [Reverse Port Forwarding Support](features.md#reverse-port-forwarding-rpfwd-support), [Usage Examples](examples.md#reverse-port-forwarding-example)

---

## System Operations

### `shell` - Execute Shell Command

Execute arbitrary shell commands on the target system by spawning cmd.exe.

**Syntax:**
```
shell <command>
```

**Parameters:**
- `command` (required): Shell command to execute.

**Examples:**
```
shell whoami
shell dir C:\Users
shell ipconfig /all
```

**Features:**
- The command is executed in a non-interactive shell and the output is captured and returned
- HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions
- Command execution and command-line arguments are logged by security tools
- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
- Always requires approval from another operator before execution

**Output:**
```
Microsoft Windows [Version 10.0.19041.1234]
(c) 2020 Microsoft Corporation. All rights reserved.

C:\Users\Administrator>whoami
desktop-abc\administrator
```

**OPSEC Considerations:**
- **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored
- Command execution and arguments are logged by EDR/XDR solutions
- Always requires operator approval (OPSEC pre-check blocks execution)
- Consider using built-in Cazalla commands instead when possible

**Related:** [OPSEC Checking](opsec.md)

---

### `screenshot` - Capture Screenshot

Capture a screenshot of the primary desktop display and upload it to the Mythic server.

**Syntax:**
```
screenshot
```

**Parameters:** None

**Examples:**
```
screenshot
```

**Features:**
- Uses Windows GDI API (BitBlt) to capture the screen content
- The screenshot is automatically uploaded as a file to Mythic for viewing
- Requires an active interactive desktop session
- May be detected by screen capture detection mechanisms, behavioral analysis, and data loss prevention (DLP) systems
- Large screenshots may trigger network monitoring alerts

**Output:**
```
[screenshot] Capturing screenshot...
[screenshot] Screenshot captured: 1920x1080 pixels
[screenshot] Uploading to Mythic...
[screenshot] Screenshot uploaded successfully
```

**OPSEC Considerations:**
- Screen capture is detected by many security tools
- May trigger behavioral analysis alerts
- Large screenshots generate network traffic
- Requires an active interactive desktop session

**Related:** [Usage Examples](examples.md#screenshot-example)

---

### `keylog_start` - Start Keylogger

Start a low-level keyboard logger that captures all keystrokes from the system.

**Syntax:**
```
keylog_start
```

**Parameters:** None

**Examples:**
```
keylog_start
```

**Features:**
- Captures all keystrokes from the system and streams them to Mythic in real-time
- Uses Windows keyboard hooking mechanisms (SetWindowsHookEx) to intercept keyboard input at a low level
- CRITICAL OPSEC RISK: Keyloggers are extremely detectable by EDR/XDR solutions, anti-malware, and behavioral analysis engines
- Detection is likely within minutes or hours
- Always requires approval from a lead operator
- Consider alternatives such as credential theft, browser credential extraction, or clipboard monitoring for better OPSEC

**Output:**
```
[keylog_start] Starting keylogger...
[keylog_start] Keyboard hook installed
[keylog_start] Keylogger active
```

**OPSEC Considerations:**
- **CRITICAL OPSEC RISK**: Extremely detectable
- Detection is likely within minutes or hours
- Always requires operator approval (OPSEC pre-check blocks execution)
- Consider alternatives for better OPSEC

**Related:** [OPSEC Checking](opsec.md), [Keylogging Support](features.md#keylogging-support)

---

### `keylog_stop` - Stop Keylogger

Stop the active keyboard logger and remove the keyboard hooks.

**Syntax:**
```
keylog_stop
```

**Parameters:** None

**Examples:**
```
keylog_stop
```

**Features:**
- This command safely terminates keylogging operations and cleans up the hooking mechanisms
- Use this command when keylogging is no longer needed to reduce detection risk and free system resources

**Output:**
```
[keylog_stop] Stopping keylogger...
[keylog_stop] Keyboard hook removed
[keylog_stop] Keylogger stopped
```

**Related:** [Keylogging Support](features.md#keylogging-support)

---

### `browser_info` - Identify Installed Browsers

Identify installed web browsers and the default browser on the target system.

**Syntax:**
```
browser_info
```

**Parameters:** None

**Examples:**
```
browser_info
```

**Features:**
- Detects multiple browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave
- Displays installation paths for each detected browser
- Shows version information when available
- Identifies the system's default browser
- Read-only operation - does not modify system state
- Low detection risk - only reads registry and file system

**Output:**
```
=== Installed Browsers ===

[1] Google Chrome
    Path: C:\Program Files\Google\Chrome\Application\chrome.exe
    Version: 120.0.6099.109.0

[2] Microsoft Edge
    Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    Version: 120.0.2210.91.0

=== Default Browser ===

Name: Google Chrome
Path: C:\Program Files\Google\Chrome\Application\chrome.exe
```

**OPSEC Considerations:**
- Low detection risk - read-only operations are rarely flagged
- Registry reads may be logged if registry auditing is enabled
- File system access may be logged if file auditing is enabled
- No process creation or network activity
- No file modifications

**Related:** [System Information Gathering](features.md#system-information-gathering), [Detailed Documentation](commands/browser_info.md)

---

### `browser_dump` - Dump Browser Credentials

Extract cookies, saved passwords, and bookmarks from web browsers.

**Syntax:**
```
browser_dump <browser>
```

**Parameters:**
- `browser` (required): Browser to dump. Must be one of: `chrome`, `firefox`

**Examples:**
```
browser_dump chrome
browser_dump firefox
```

**Features:**
- Supports Chrome and Firefox
- Extracts cookies (display only), saved passwords, and bookmarks
- Automatically decrypts browser-protected credentials
- Reports saved passwords to Mythic's credential store (cookies are NOT stored)
- Smart cookie filtering: Only shows session cookies useful for authentication
- HIGH OPSEC RISK: Browser credential access is heavily monitored

**Output:**
```
============================================
||               Cookies                  ||
============================================

- URL: example.com
- Cookie: session_id=abc123...

============================================
||              Saved logins              ||
============================================

- URL: https://example.com
- Username: user@example.com
- Password: mypassword123
```

**Credential Reporting:**
- **Passwords**: Automatically saved to Mythic's credential store
- **Cookies**: Displayed in output but NOT stored as credentials

**OPSEC Considerations:**
- HIGH DETECTION RISK - Browser credential access is heavily monitored
- EDR/XDR solutions have specific detection rules
- File access to browser databases triggers alerts
- Detection is likely within minutes
- Always requires approval from another operator

**Related:** [Browser Information Command](commands/browser_info.md), [Detailed Documentation](commands/browser_dump.md)

---

## Control Commands

### `sleep` - Adjust Beacon Interval

Change the agent's sleep interval (check-in frequency) and optional jitter percentage.

**Syntax:**
```
sleep {"seconds":30,"jitter":10}
```

**Parameters:**
- `seconds` (required): Sleep interval in seconds
- `jitter` (optional): Jitter percentage (0-100)

**Examples:**
```
sleep {"seconds":30,"jitter":10}
sleep {"seconds":60}
sleep {"seconds":10,"jitter":30}
```

**Features:**
- The sleep interval determines how long the agent waits between check-ins with the Mythic server
- Jitter adds random variation to the sleep interval to avoid predictable timing patterns
- Lower sleep values provide more responsive interaction but increase network activity and detection risk
- Higher sleep values reduce detection risk but make the agent less responsive
- Jitter helps evade behavioral detection based on timing analysis

**Output:**
```
[sleep] Sleep interval set to: 30 seconds
[sleep] Jitter set to: 10%
```

**Recommendations:**
- **Initial deployment**: 30-60 seconds with 10-30% jitter
- **Interactive operations**: 5-10 seconds with 10-20% jitter
- **Stealth mode**: 60-120 seconds with 20-40% jitter

---

### `exit` - Terminate Agent

Instruct the agent to exit and terminate.

**Syntax:**
```
exit
```

**Parameters:** None

**Examples:**
```
exit
```

**Features:**
- The agent will perform cleanup operations and then terminate its process
- This command is permanent - the agent will stop running and will not check in again
- Use this command when you want to remove the agent from the target system or when operational requirements dictate agent termination
- Compatible with Mythic's callback table exit functionality

**Output:**
```
[exit] Terminating agent...
[exit] Agent exited
```

**Warning:** This command permanently terminates the agent. The agent will not automatically reconnect.

---

## Command Parameter Formats

### JSON Parameters

Some commands require JSON-formatted parameters:

- `socks`: `{"action":"start","port":7002}`
- `rpfwd`: `{"action":"start","port":8080,"remote_host":"127.0.0.1","remote_port":80}`
- `sleep`: `{"seconds":30,"jitter":10}`
- `make_token`: Dictionary with `domain`, `username`, `password`, `logon_type`

### String Parameters

Most commands use simple string parameters:

- `ls C:\Users`
- `cd C:\Windows\System32`
- `cat file.txt`
- `kill 1234`

### Path Handling

- **Absolute paths**: `C:\Users\Administrator\Desktop\file.txt`
- **Relative paths**: `file.txt` (resolved using current working directory)
- **Path normalization**: Double backslashes are automatically normalized

---

## Command Output Formatting

Commands output information in a consistent format:

- **Success messages**: `[command] Operation completed: details`
- **Error messages**: `[command] Error: description (Code: error_code)`
- **Progress messages**: `[command] Progress: current/total`

---

## Related Documentation

- [Getting Started Guide](getting-started.md) - Installation and first steps
- [Features Overview](features.md) - Detailed feature explanations
- [OPSEC Guide](opsec.md) - Security considerations
- [Usage Examples](examples.md) - Practical examples
- [Troubleshooting Guide](troubleshooting.md) - Common issues and solutions

---

**Last Updated:** 2024