Skip to main content
Tasking references let an operator select Mythic-tracked objects without copying their raw values into the command line. Mythic resolves references before the payload type’s tasking functions run, records how each value was resolved, and sends the resolution metadata to the container. Set resolve_task_references: true when creating tasks through GraphQL. The Mythic UI enables resolution for supported tasking paths.

​
Credential references

Use a credential’s operation-scoped database ID:
For a CredentialJson parameter, this resolves to the complete structured credential. In a string parameter, select one field:
The credential must exist, not be deleted, and belong to the current operation. @link resolves structured AgentConnect parameters from a callback or payload. Use comma-separated key=value arguments:
  • callback is the callback display ID and must identify an active callback in the operation.
  • payload is a successfully built payload UUID. host records a payload-on-host relationship after task creation.
  • c2 is optional when Mythic can choose an unambiguous C2 profile.

​
Edge references

For a structured LinkInfo parameter, reference a P2P callback graph edge:
The edge must be connected to the callback being tasked. Mythic resolves the opposite callback, its payload, C2 profile, and connection parameters. The wire form is @link:edge=<callbackgraphedge_id>.

​
Container resolution metadata

Each task includes keyword_resolution entries:
Container libraries expose helpers to reconstruct the operator’s original expression when display parameters should avoid showing sensitive expanded values:
Resolution is operation-scoped and happens on the server. Payload type code should consume the expanded value and use the recorded metadata for display or audit context; it should not query a second time just to resolve the same reference.