Process_List
This process_list structure needs to be in the user_output field of a post_response message. This allows the Mythic server to pick up the array from a predictable location, allows the information to be presented to operators, and allows browser scripts to act on the data as well. Look to Action: post_response for the post response format.
The is_process_list flag on the command that will be sending this output needs to be true for the server to specifically parse this data into the unified process listing view instead of just displaying it to the user
There are many instances where you might have multiple agents running on a single host and you run common tasking like process lists over and over and over again. You often do this because the tasking has scrolled out of view, maybe it's just stale information, or maybe you couldn't quite remember which callback actually had that task. This is where the unified process listing comes into play.
With a special format for process listing, Mythic can track all the different process lists together for a single host. It doesn't matter which host you ran the task on, as long as you pull up the process_list view for that host, all of the tasks will be available and viewable.
Naturally, this has a special format for us to make it the most useful. Like almost everything else in Mythic, this requires structured output in JSON:
[{"process_id": pid,"architecture": "x64","name": "lol.exe","user": "its-a-feature","bin_path": "C:\whatever","parent_process_id": ppid}]
All that's needed is an array of all the processes with the above information in the user_output field of your post_response action. That allows Mythic to create a process hierarchy (if you supply both process_id and parent_process_id) and a sortable/filterable table of processes.
This new view also allows you to diff two different process listing outputs to see what processes were added or removed.
​
