inject_net_users

What inject_net_users does on Cobalt Strike MCP Server

AI agents call inject_net_users to retrieve information from Cobalt Strike MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why inject_net_users is rated Low

This tool retrieves user account information from a domain without creating, modifying, or destroying data. It falls squarely in the Read category. Severity is medium rather than low because enumerating domain users is valuable reconnaissance that could enable lateral movement or targeted attacks, making it a moderate security risk if misused by an AI agent, though the tool itself performs no destructive actions.

From the tool's definition Tool name 'inject_net_users' and description 'Enumerate users in the domain' indicate data retrieval with no modification or deletion. The 'enumerate' verb confirms this is a query operation.

The rule that runs inject_net_users safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For inject_net_users, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "inject_net_users": {}
  }
}

Questions about inject_net_users