Overview
An execution unit (ExecUnit) is executable code supplied by a plugin for an agent to host. This section explains the architecture of command and listener ExecUnits, their platform differences, and their relationship to the protocol references.
Components and responsibilities
The diagram separates the components on the Command and Control (C2) side from the components hosted on the agent machine. Lines show relationships, not startup order or wire messages.
| Component | Responsibility |
|---|---|
| Agent core | Coordinates work, hosts supported ExecUnits, and maintains the agent's state. |
| Command ExecUnit | Performs a particular task and reports its output and outcome to the agent. |
| Listener ExecUnit | Provides the agent-side transport role, exchanging external traffic and communicating locally with the agent core. |
| C2 command plugin | Supplies command-specific configuration and interprets results. |
| C2 listener plugin | Implements the corresponding C2-side listener behavior. |
A listener plugin can also own command ExecUnits. Their packaging does not change their role: they still belong to the command lifecycle and command protocol. Listener ExecUnits explains this distinction.
Shellcode is one ExecUnit format. Native libraries and managed assemblies are other formats where supported. A native command is instead built into the agent; the word “native” alone does not tell you whether code is built in or supplied by a plugin.
Choose a reading path
Start with Concepts and Lifecycle and Formats and Compatibility. Then follow the path matching the role you are working with:
| Your focus | Read next |
|---|---|
| Commands, including listener-owned commands | Command ExecUnits, then the command protocol reference. |
| Listeners | Listener ExecUnits, then the listener protocol reference. |
| Local communication on the agent machine | Local Communication, followed by your OS page. |
| Compatibility or lifecycle questions | Limitations and Diagnostics. |
Each OS has its own page: Windows, Linux, FreeBSD, and macOS. Windows behavior is not a template for every platform. In particular, Windows duplex named pipes and POSIX filesystem FIFOs have different endpoint and resource models.
Where protocol details live
This section describes responsibilities, conceptual lifetimes, and platform constraints. Architecture → Protocols owns encoding definitions and message references:
- TLV describes the common type-length-value representation.
- Agent and Command ExecUnits describes the command-side messages.
- Agent and Listener ExecUnits describes the listener-side messages.
- C2 Agent describes the separate agent-to-C2 protocol.
The shared encoding does not make these protocols interchangeable. Local IPC, command results, listener transport traffic, and the C2 protocol have different responsibilities even when one carries data belonging to another.
Coverage
The platform pages describe the current commercial runtime and the default command and listener implementations. A capability available in the runtime does not establish that every plugin supplies a matching artifact, or that every payload build enables that capability. Check both the role and the platform in the compatibility tables.
These pages provide an architectural reference. They are not a standalone loader implementation or a replacement for the protocol references.