Scans, jobs and execution¶
How work actually runs: on your machines, through the platform.
Availability: both editions. Access: scan types map to
permissions (hosts.create for nmap/NetExec, findings.create for
nuclei, scans.run for generic exec); job approvals need
project.manage_members.
Attacker targets¶
Tooling never runs in the Umbryx containers. Configure an executor in Infra → Connections: an attacker SSH target (host, port, credential, optional jump/SOCKS proxy) or a pool workstation with the executor flag. See Attacker SSH.
Scans¶
Left-rail types:
| Type | Notes |
|---|---|
| Nmap | target from scope, flags, intensity profile (stealth/normal/aggressive), timeout |
| Nuclei | URL target, templates, severity filter, extra flags |
| NetExec | smb/winrm/rdp/ldap/mssql protocols with username/password/NTLM |
| DonPAPI | DPAPI collection with automatic loot harvesting |
| Bulk host import | IP/CIDR list → hosts |
Execution source: direct attacker host or an active pivot listener (SOCKS). Every scan creates a Job.
Watch (surface monitoring)¶
Watches re-run a light nmap over scope on an interval (15m … 1d), keep a baseline, and diff changes: new hosts, new ports, service and status changes. Run-now, pause/resume, per-watch last diff.
Jobs¶
- Statuses: queued → running → done/failed/cancelled, plus awaiting ROE approval
- Live output over SSE (redacted to a placeholder for roles without
credentials.read_secret); structured result badges (auth ok, access role, candidates found, hosts created) - Actions: approve/reject (ROE gate), retry, rerun, cancel, delete
- Artifacts (loot) attached to the job; chain suggestions propose next steps
Commands and bulk execution¶
- Commands tab — snippet library with
{{IP}}/{{USER}}/{{PASS}}substitution and "Run on attacker" - Bulk Run (hosts selection) — one command across many hosts; every run is a job with per-host results
- ROE/scope guards apply to all of the above; violations fail the job or pause it for approval
Expected behavior¶
- Results create hosts/findings/creds automatically
- Cancellations stop the actual subprocess, not just the DB record
Limitations¶
- Tools must exist on the attacker machine; the platform does not install them
- Approvals require an owner/admin-level member