Event workflow actions as …?
If you’re thinking about creating an eventing workflow, but curious who these actions would run as, then you’re in the right spot! It shouldn’t be the case where something takes actions as you without you knowing it. Mythic tracks everything that’s happening, so if an action happens on your behalf that you didn’t authorize, then it starts to break down that model. Instead, there’s therun_as
field in the workflow file and required consent. Let’s break it down.
bot
Every time an operation is created, a “bot” account is also created and added to the operation as a standard “operator”. More detail on the accounts can be found here. The default operational context for a workflow is the “bot” account for the operation. However, we don’t want just anybody to upload workflows to do arbitrary things within Mythic. That could get dangerous. Instead, anybody can upload the workflow files, but if the execution context is for the bot, then the admin of the operation must approve it to run.

If you leave
run_as
blank or omit it entirely, then bot
is the default value used.self
Arun_as
value of self
means that the workflow will execute under the context of the operator that uploaded it.
trigger
Arun_as
value of trigger
means that the workflow will execute under the context of the operator that triggered it (or bot if there wasn’t an explicit trigger). For this case, each operator must provide their consent or it’ll fail to run for operators that don’t provide consent.
lead
Arun_as
value of lead
means that the workflow will execute under the context of the operation admin. Naturally, the operation admin must approve this before this can execute.
anything else
If you supply a value torun_as
that’s none of the above header values (bot, self, trigger, lead), then it’s assumed that you’re trying to run within the context of a specific operator. If the name matches an existing operator, then that operator must be part of the operation and have granted consent. If you specify the name of a bot, then the lead of the operation must grant consent first.