High-risk tools in Cobalt Strike MCP Server

High severity Cobalt Strike MCP Server MCP Server 113 of 220 tools

113 of the 220 tools in Cobalt Strike MCP Server are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

beacon_change_directory Execute

Change current directory on a beacon
beacon_copy_file Execute

Copy a file on a beacon
create_listener Execute

Create a new listener (HTTP, HTTPS, DNS, SMB, etc.)
create_listener_dns Execute

Create a DNS listener
create_listener_externalC2 Execute

Create an ExternalC2 listener
create_listener_foreignHttp Execute

Create a Foreign HTTP listener
create_listener_foreignHttps Execute

Create a Foreign HTTPS listener
create_listener_http Execute

Create an HTTP listener
create_listener_https Execute

Create an HTTPS listener
create_listener_smb Execute

Create an SMB listener
create_listener_tcp Execute

Create a TCP listener
create_listener_userDefinedC2 Execute

Create a User-Defined C2 listener
elevate_beacon Execute

Elevate to a new beacon with higher privileges
elevate_command Execute

Elevate a command with higher privileges
execute_beacon_command Execute

Execute a command on a beacon (e.g.,
execute_bof Execute

Execute a BOF (Beacon Object File) on a beacon. Common BOFs: @artifacts/BOFs/whoami.x64.o, @artifacts/BOFs/whoami.x86.o
execute_bof_pack Execute

Execute a BOF with packing
execute_bof_packed Execute

Execute a packed BOF
execute_browserpivot_stop Execute

Stop browser pivot
execute_cancel_file_download Execute

Cancel file download
execute_checkin Execute

Force beacon to check in immediately
execute_exit Execute

Exit the beacon
execute_get_system Execute

Get SYSTEM privileges
execute_get_uid Execute

Get user ID
execute_job_stop Execute

Stop a job
execute_kerberos_ticket_use Execute

Use a Kerberos ticket
execute_kill_process Execute

Kill a process by PID
execute_link_smb Execute

Link to SMB beacon
execute_link_tcp Execute

Link to TCP beacon
execute_make_token Execute

Make a token using logon credentials
execute_make_token_upn Execute

Make a token using UPN (User Principal Name)
execute_net_domain Execute

Get domain information
execute_powershell_import Execute

Import PowerShell module
execute_rev2self Execute

Revert to self (drop impersonated token)
execute_rportfwd_start Execute

Start reverse port forward
execute_rportfwd_stop Execute

Stop reverse port forward
execute_setenv Execute

Set an environment variable
execute_socks_stop Execute

Stop SOCKS proxy
execute_socks_stop_port Execute

Stop SOCKS proxy on specific port
execute_socks4_start Execute

Start SOCKS4 proxy
execute_socks5_start Execute

Start SOCKS5 proxy
execute_steal_token Execute

Steal a token from a process
execute_timestomp Execute

Modify file timestamps
execute_tokenStore_steal Execute

Steal a token and add it to the token store
execute_tokenStore_stealAndUse Execute

Steal a token and immediately use it
execute_tokenStore_use Execute

Use a token from the token store
execute_unlink Execute

Unlink from beacon
generate_stageless_payload Execute

Generate a stageless payload for a listener
generate_stager_payload Execute

Generate a stager payload for a listener
inject_beacon Execute

Inject beacon into a process
inject_browserpivotStart Execute

Start browser pivot
inject_dll Execute

Inject a DLL into a process
inject_hashdump Execute

Dump password hashes (inject mode)
inject_keylogger Execute

Start keylogger on a process
inject_loadDll Execute

Load DLL
inject_mimikatz Execute

Run Mimikatz (inject mode)
inject_net_view Execute

View network resources
inject_portscan Execute

Perform port scan
inject_postExDll Execute

Load post-exploitation DLL
inject_powershell_unmanaged Execute

Execute unmanaged PowerShell
inject_printscreen Execute

Print screen (inject mode)
inject_pth Execute

Pass-the-hash attack
inject_screenshot Execute

Take screenshot (inject mode)
inject_screenwatch Execute

Start screen watch (inject mode)
inject_shellcode Execute

Inject shellcode into a process
inject_ssh Execute

Inject SSH session
inject_sshKey Execute

Inject SSH session with key
remoteExec_beacon Execute

Remotely execute a beacon on a target
remoteExec_command Execute

Remotely execute a command on a target
set_beacon_beacon_gate Execute

Enable or disable beacon gate
set_beacon_block_dlls Execute

Enable or disable block DLLs
set_beacon_c2_host_hold Execute

Hold C2 host (prevent failover)
set_beacon_c2_host_release Execute

Release C2 host (allow failover)
set_beacon_dns_mode Execute

Set DNS mode for beacon
set_beacon_ppid Execute

Set the parent process ID for a beacon
set_beacon_sleep Execute

Set the sleep time and jitter for a beacon
set_beacon_spawnto Execute

Set the spawn-to process for a beacon
set_beacon_spoofed_arguments Execute

Set spoofed arguments for beacon
set_beacon_syscall_method Execute

Set the system call method for a beacon
spawn_beacon Execute

Spawn a new beacon session on a target
spawn_beacon_asUser Execute

Spawn a beacon as a specific user
spawn_beacon_under Execute

Spawn a beacon under a specific process
spawn_chromedump Execute

Dump Chrome passwords (spawn mode)
spawn_command Execute

Execute a command on a beacon (spawns in new process)
spawn_command_runAs Execute

Run a command as a specific user
spawn_command_runNoOutput Execute

Run command without output
spawn_command_runUnder Execute

Run command under a process
spawn_dcsync Execute

Perform DCSync attack (spawn mode)
spawn_dotnetAssembly Execute

Execute .NET assembly
spawn_hashdump Execute

Dump password hashes from a beacon
spawn_keylogger Execute

Start keylogger (spawn mode)
spawn_mimikatz Execute

Run Mimikatz on a beacon
spawn_net_computers Execute

Enumerate computers (spawn mode)
spawn_net_domainTrusts Execute

Enumerate domain trusts (spawn mode)
spawn_net_group Execute

Enumerate groups (spawn mode)
spawn_net_sessions Execute

Enumerate sessions (spawn mode)
spawn_net_share Execute

Enumerate shares (spawn mode)
spawn_net_time Execute

Get time from target (spawn mode)
spawn_net_user Execute

Enumerate users (spawn mode)
spawn_net_user_detail Execute

Get user details (spawn mode)
spawn_net_view Execute

View network resources (spawn mode)
spawn_portscan Execute

Perform port scan (spawn mode)
spawn_postExDll Execute

Load post-exploitation DLL (spawn mode)
spawn_powershell Execute

Execute PowerShell command on a beacon
spawn_powershell_unmanaged Execute

Execute unmanaged PowerShell (spawn mode)
spawn_printscreen Execute

Print screen (spawn mode)
spawn_pth Execute

Pass-the-hash (spawn mode)
spawn_screenshot Execute

Take a screenshot on a beacon
spawn_screenwatch Execute

Start screen watch (spawn mode)
spawn_shell Execute

Execute a shell command on a beacon
spawn_shellcode Execute

Execute shellcode (spawn mode)
spawn_ssh Execute

Inject SSH session (spawn mode)
spawn_sshKey Execute

Inject SSH session with key (spawn mode)

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in Cobalt Strike MCP Server

Tools at high risk

Attacks that target this class

More on Cobalt Strike MCP Server

Enforce policy on every Cobalt Strike MCP Server tool call.