spawn_process_list

What spawn_process_list does on Cobalt Strike MCP Server

AI agents call spawn_process_list to retrieve information from Cobalt Strike MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why spawn_process_list is rated Low

This tool retrieves process information from a compromised endpoint (beacon) without modifying or destroying anything. It is fundamentally a read operation. Severity is high because Cobalt Strike is a red team/attack framework and this tool provides reconnaissance data that could be used to identify security software, determine lateral movement targets, or find privilege escalation opportunities.

From the tool's definition Tool name and description indicate it 'List processes on a beacon' - a query/retrieval operation with no modification or deletion of data or system state.

The rule that runs spawn_process_list safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For spawn_process_list, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "spawn_process_list": {}
  }
}

Questions about spawn_process_list