execute_powershell_import

What execute_powershell_import does on Cobalt Strike MCP Server

AI agents invoke execute_powershell_import to trigger actions in Cobalt Strike MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why execute_powershell_import is rated High

Importing PowerShell modules allows arbitrary code execution with the privileges of the running beacon process on a target system. This is fundamentally an Execute action (runs code whose effects depend on which module is imported and what that module does). Within a Cobalt Strike context, this is a critical capability for post-exploitation.

From the tool's definition Tool enables 'Import PowerShell module' which executes PowerShell code; server description states '200+ tools for beacon control' indicating offensive security operations; context of Cobalt Strike (adversary simulation framework) with beacon control tools…

The rule that runs execute_powershell_import safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For execute_powershell_import, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "execute_powershell_import": {
      "limits": [
        {
          "counter": "execute_powershell_import_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about execute_powershell_import