spawn_net_localGroup

What spawn_net_localGroup does on Cobalt Strike MCP Server

AI agents call spawn_net_localGroup to retrieve information from Cobalt Strike MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why spawn_net_localGroup is rated Low

This tool retrieves group membership and local group data from a compromised system. While it is a Read operation (no data is modified or deleted), severity is high because: (1) it operates within Cobalt Strike, a red team framework assuming post-compromise context, (2) enumeration of local groups is reconnaissance that enables privilege escalation or lateral movement planning, and (3) in the context of other…

From the tool's definition Tool name 'spawn_net_localGroup' and description 'Enumerate local groups (spawn mode)' indicate querying/retrieval of local group information without modification. The 'Enumerate' verb explicitly signals a read operation.

The rule that runs spawn_net_localGroup safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For spawn_net_localGroup, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "spawn_net_localGroup": {}
  }
}

Questions about spawn_net_localGroup