Skip to main content

What is it?

OnContainerStartFunction and on_container_start are functions you can optionally implement in any container to get execution, per operation, when the container starts up. This is helpful when your container needs to do some housekeeping and prep an agent, c2 profile, or even eventing before anything else happens.

Where is it?

This function is one you can implement as part of the definition for your container (PayloadType, C2Profile, Eventing, etc).

What does it do?

This function receives an opaque API token that is valid for five minutes. Mythic 4.0 grants explicit scopes for supported startup work, including eventing, payload, file, tag, callback, and chat actions, under the operation’s active bot identity. The token is also represented by the authenticated RabbitMQ context on the request. If the function calls protected HTTP or GraphQL endpoints, send the supplied value as Authorization: Bearer <token>. Do not persist the token, or assume it has global * access.

When is it called?

This function is called when your container first comes online and syncs with Mythic. It’s also called (as of Mythic 3.3.1-rc26) when anybody adds/removes/edits a file inside of your container through the UI. This allows you, the container developer, to be reactive to changes users make to files that might affect things like configurations.