Mythic File Backend#

The Mythic file backend serves payloads directly from Mythic’s file store through InfraGuard’s filter pipeline. Instead of hosting payloads on a separate file server or syncing files manually, you point a content route at Mythic and InfraGuard proxies the download, applying all the usual filtering before the payload reaches the requester.

How It Works#

When a request matches a content route using the mythic_file backend, InfraGuard proxies the request to Mythic’s /direct/download/{uuid} endpoint. The response body (the payload binary) is streamed back to the client.

Target --> InfraGuard --> filter pipeline --> Mythic /direct/download/{uuid}
                                                      |
                                                  payload binary
                                                      |
                                              <-- streamed back to target

Delivery Modes#

Fixed File ID#

Serve a specific file from Mythic regardless of the request path. Useful when you have a single payload mapped to a download URL.

content_routes:
  - uri: "/update.exe"
    backend:
      type: "mythic_file"
      mythic_url: "https://10.0.0.5:7443"
      api_key: "${MYTHIC_API_KEY}"
      file_id: "abc123-def456-..."

Every request to /update.exe serves the same Mythic file.

Dynamic UUID Extraction#

Extract the Mythic file UUID from the request path. Useful when you want a single route to serve multiple payloads.

content_routes:
  - uri: "/d/*"
    backend:
      type: "mythic_file"
      mythic_url: "https://10.0.0.5:7443"
      api_key: "${MYTHIC_API_KEY}"
      uuid_from_path: true

A request to /d/abc123-def456 extracts abc123-def456 from the path and fetches that UUID from Mythic.

Configuration#

content_routes:
  - uri: "/payloads/*"
    backend:
      type: "mythic_file"
      mythic_url: "https://10.0.0.5:7443"    # Mythic server URL
      api_key: "${MYTHIC_API_KEY}"             # Mythic API key for authentication
      file_id: "..."                           # fixed file UUID (optional)
      uuid_from_path: true                     # extract UUID from request path (optional)
      verify_ssl: false                        # skip TLS verification for self-signed certs
    rate_limit:
      requests: 3
      window_seconds: 3600

Set either file_id (fixed mode) or uuid_from_path: true (dynamic mode), not both.

Security Considerations#

• The Mythic API key should be stored encrypted (see Config Encryption) or injected via environment variable
• Combine with Content Rate Limiting to prevent repeated downloads from the same IP
• When using uuid_from_path, the UUID is extracted directly from the URL path. InfraGuard does not validate that the UUID exists in Mythic before proxying; Mythic will return a 404 for invalid UUIDs
• verify_ssl: false is common since Mythic typically runs with self-signed certificates on internal networks