A monolithic implant spends its entire life carrying everything it might ever need: every byte is disk footprint, memory signature, and AV surface, paid on every host whether the feature is used or not. The AXIS C agent takes the other side of that trade. The core is 225 KB and does almost nothing — channel, timing, task dispatch, crypto, and a module loader. Everything an operator would recognize as a capability was moved out, release by release, into the depot.
What the core carries — and what it doesn't
The split is the whole design, so here it is in one table:
| Piece | Lives in | Resident | Notes |
|---|---|---|---|
| Core agent | the artifact | always | ≈ 225 KB — channel, timing, dispatch, crypto, loader |
| Shells & interactive PTY | depot | while tasked | fetched on first shell command, shimmed into the core |
| File manager | depot | while tasked | chunked transfers stream back as module results |
| Tunnels & peer routing | depot | while tasked | SOCKS, reverse tunnels, named-pipe mesh |
| SMB browser | depot | while tasked | share access with token impersonation |
| BOF runtime | depot | while tasked | crash-guarded; a fault returns an error, not the session |
| Credentials · LDAP · AD · shares · scanner | depot | while tasked | the collection set, in-memory only |
| Elevation | depot | while tasked | C agent on Windows only — gated by agent type |
How a module arrives
The depot is per-OS and per-profile: Windows gets DLLs, Linux gets shared objects routed by the build-target profile — server, NAS-legacy, embedded each draw from their own pool — macOS gets libraries. The server gates the set by agent type and platform: elevation is offered to the C agent on Windows only, cron persistence only where cron exists. A fetch is a deliberate, auditable moment:
Each module travels encrypted with its own key derived from the session, behind a one-time download token; results chunk back over the same channel; unload wipes the key material. The operator-facing record of all of this is a line in the audit log — module, target, operator, timestamp.
{
"module": "filemgr",
"target": "windows-x64",
"pool": "core/win · routed by build profile",
"fetch": "one-time token · single use",
"key": "per-module · derived from session",
"results": "chunked stream",
"unload": "wipe + release"
}
What the budget buys
A quiet agent is nearly weightless: 225 KB on disk, a thin memory profile, and nothing resident that a scanner can name. The capability arrives exactly when the engagement needs it and leaves when it doesn't — and because modules are per-customer builds like everything else we ship, the depot inherits the same polymorphism as the core. The Go agent takes the opposite bet — a wider command set resident in an 8 MB binary — and both run in one fleet, because the honest answer to "which implant" is it depends on the host, and the panel shouldn't punish you for answering honestly.
The defender's angle
The fetch is the loud moment.
Modularity is also a detection surface, and pretending otherwise would make this note marketing. A one-time-token download of an encrypted payload, shortly before new behavior appears in a process that was quiet for days. Memory scanners earn their keep in the window between load and wipe; the wipe itself shortens that window but doesn't erase the fetch. If your telemetry can join "unusual download token redeemed" with "previously quiet process now browsing files," you have found the seam we spend engineering effort making narrow. That is the recurring lesson from the telemetry map: durable implants shrink sequences; good defenders stretch them back out.
Next in the queue: a field guide to common bypass techniques — what each one still costs you, and why single-trick implants age badly.