Example (user tasking):
Any command is able to reply with its own artifacts that are created along the way. The following response can be returned as a separate C2 message or as part of the command’s normal output.The following response is part of the normal agent response. So, it is base64 encoded and put in the normal response format
Example (agent response):
Walkthrough:
Agents can report back their own artifacts they create at any time. They just include anartifacts
keyword with an array of the artifacts. There are two components to this:
base_artifact
is the type of base artifact being reported.artifact
is the actual artifact being created. This is a free-form field.needs_cleanup
- this is an optional field that indicates if this artifact will need to be cleaned up at some pointresolved
- this is an optional field that indicates if the artifact is already cleaned up