spawn_command_runAs

What spawn_command_runAs does on Cobalt Strike MCP Server

AI agents invoke spawn_command_runAs to trigger actions in Cobalt Strike MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why spawn_command_runAs is rated High

This tool executes arbitrary commands with user impersonation capabilities, making it Execute category. Severity is critical because: (1) it enables arbitrary code execution on target systems; (2) it can run with elevated privileges via runAs; (3) in a red team tool like Cobalt Strike, it represents a primary attack vector; (4) misuse by an AI agent could compromise any system the beacon has access to.

From the tool's definition Tool performs 'Run a command as a specific user' (direct quote), enabling execution of arbitrary commands with elevated or alternate user privileges on compromised systems. This is core Cobalt Strike beacon functionality for command execution.

The rule that runs spawn_command_runAs safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For spawn_command_runAs, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "spawn_command_runAs": {
      "limits": [
        {
          "counter": "spawn_command_runas_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about spawn_command_runAs