​
What are actions?

Actions are what indicate to Mythic what kind of message you’re sending. There’s staging_rsa (for doing EKE staging), checkin for going from payload -> callback, post_response for exclusively sending output about tasks, and get_tasking which allows you to get tasks as well as sending output about tasks.
  • Action: checkin - Initial checkin messages and key exchanges
  • Action: get_tasking - Sending response data for tasks, socks, rpfwd, delegates, but ALSO getting new tasks.
  • Action: post_response - Sending response data for tasks, socks, rpfwd, delegates, but NOT getting new tasks.
The main difference between get_tasking and post_response is just that you can get new tasks from get_tasking. Otherwise, everything you can send / get as part of a post_response message also applies to get_tasking messages.
All of the features listed in this “Hooking Features” section apply to both get_tasking and post_response messages because they can both include a responses array.