Ares-mythic/documentation-payload/ares/commands/inline_assembly.md at 9f0471b6825e98cf7befb4685240c0c582079467

mirror of https://github.com/Aryma-f4/Ares-mythic.git synced 2026-06-12 23:34:12 +00:00

Files

Aryma 03d283cf49 refactor(payload): rename apollo to ares and update documentation

This commit renames the Apollo payload type to Ares, moving all associated files and updating documentation accordingly. The change includes:
- Renaming directories from `apollo` to `ares`
- Updating documentation image references
- Maintaining the same code functionality while changing the payload name
- Adding new Ares-specific documentation files
- Removing old Apollo documentation files

The rename is done to reflect the new payload name while preserving all existing functionality.

2026-04-14 14:02:44 +07:00

1.1 KiB

Raw Blame History

+++ title = "inline_assembly" chapter = false weight = 103 hidden = false +++

Summary

Execute a .NET Framework assembly in-process with the specified arguments. This assembly must first be cached in the agent using the register_assembly command before being executed.

{{% notice warning %}} This command does not patch Environment.Exit, and as a result, should the assembly call this function, the agent itself will exit. {{% /notice %}}

Arguments

Assembly

The name of the assembly to execute. This must match the file name used with register_file.

Arguments (optional)

Arguments to pass to the assembly.

Usage

inline_assembly -Assembly [assembly_name] -Arguments [arguments]
inline_assembly [assembly_name] [arguments]

Example

inline_assembly SeatBelt.exe --groups=all

MITRE ATT&CK Mapping

T1547

Special Thanks

Mayllart submitted the initial PR for this module. You can find him on his socials here:

Social	Handle
Github	https://github.com/thiagomayllart
Twitter	@thiagomayllart
BloodHoundGang Slack	@Mayllart

1.1 KiB Raw Blame History