AXIS
REV 0328 · 2026-09
Your entire engagement runs in a browser tab. AXIS is a commercial command-and-control platform: one teamserver, agents for Windows, Linux, macOS, and embedded targets down to ARMv5 — and a web panel that carries the whole operation, from any machine you trust.
05 platform profiles 13 delivery formats 23 traffic profiles 67 object library 0 license callbacks
rev 0328 — no static, on-execute, or behavioral verdicts across the tracked AV/EDR matrix. How we measure
AXIS
/ Search agents… (Ctrl+F)
🌍 All Countries
All Status
The web panel is not a companion view — it is the whole product. Build an agent, mint a stager token, run a BOF, browse a target’s files, open a tunnel: all of it from a browser, on any operating system, from anywhere you can reach your teamserver.
The panel is a single-page app served by the teamserver itself, in English and Russian. Operators sign in with a password and an optional TOTP second factor — nothing to install, nothing to license per machine, nothing to carry.
Builder with live log, interactive terminal, file manager, tunnels, BOF repository, campaigns, users, keys, audit — the browser panel holds every operator feature. The desktop client exists for teams that want one, not because the panel lacks anything.
Everything the panel does is a REST call with the same token. Automate builds, tasking, and reporting from your own tooling — the API is the panel’s API, not a reduced second interface.
The panel is the product.
Everything else is an agent and a protocol. If a capability cannot be reached from a browser tab, it does not ship.
Six views into the edition. The full reference — ten chapters, fifty-three entries — is on the capabilities page.
Queued command shell and a real interactive PTY. Managed code in process. A crash-guarded Beacon-compatible BOF runtime with a 67-object library. A fault in a tasked tool returns an error; it never costs the session.
Stagers for Windows, Linux, and macOS; Ghost Stream MSI; payload pools that serve a different build per delivery; polymorphic per-customer builds; Authenticode signing in the pipeline.
Paced scanner, paged LDAP browser, AD discovery with BloodHound export, in-memory credential module, SAM/NTDS, share survey.
X25519 + AES-256-GCM sessions, 23 traffic profiles, an optional Cloudflare front, key rotation without a fleet rebuild, and Ghost Chain recovery when the path home dies.
Windows 7→11 and Server, modern Linux, old-glibc NAS, static embedded down to ARMv5, macOS on Apple silicon and Intel. A 225 KB core fetches everything else — shells, files, tunnels, BOF, collection — from the on-demand module depot.
Per-install identity. Ghost-Svchost, Ghost-Path, and Ghost Write on Windows; Ghost-Systemd/Cron on Linux; Ghost-Launchd on macOS. Live timing, visibility controls, and OTA updates with a recovery path.
persistenceSessions with TOTP, builds, tasked commands, approvals, tunnel opens, key rotations — each lands in a per-campaign, filterable audit log, exportable to CSV. Thirteen grants decide who sees and who does.
AXIS
/ Search agents… (Ctrl+F)
🌍 All Countries
All Status
Every operator-facing capability in AXIS, with its scope and its limits. Implementation detail stays in the licensed material.
C and Go agents; five platform profiles; on-demand module depot; per-customer unique builds.
02axis-v1, encrypted sessions, 23 traffic profiles, Cloudflare front, Ghost Chain, key rotation.
0313 stager formats, Ghost Stream MSI, payload pools, one-time tokens, in-pipeline signing.
04Queued shell, interactive PTY, in-process .NET, crash-guarded BOFs, shared token context.
05Chunked file manager with ADS and SMB sessions, SOCKS5 and reverse tunnels, named-pipe routing.
06Scanner, LDAP, AD discovery, credential module, SAM/NTDS, share survey.
07Preflight, then elevate. Windows C agent only; methods ship in the licensed build.
08Install / status / remove on Windows, Linux, macOS; per-install identity; Ghost methods on every OS.
09Live timing and visibility controls, AV/EDR reporting, OTA updates with recovery.
10RBAC with 13 grants, TOTP, audit export, campaigns, offline license, EN/RU panel.
| Profile | Targets | Agent | Modules | Persistence |
|---|---|---|---|---|
| Windows | 7 → 11, Server x86 · x64 |
C agent ≈ 225 KB, or Go agent ≈ 8 MB with the full command set resident | Loaded on demand; full depot incl. credentials, directory, elevation, shares | Run keys, Startup, task, service, WMI, COM, sideload, BITS, Ghost-Path, Ghost-Svchost |
| Linux server | Ubuntu, Debian, RHEL-family x86_64 · arm64 |
C agent, dynamic glibc | Shared objects, loaded on demand (core set) | Ghost-Systemd — unit + per-machine launcher |
| NAS / legacy | Old-glibc filers and appliances x86_64 · arm64 · armv7 |
C agent, compatibility build | Core set, built against the older baseline | Ghost-Cron where no systemd exists |
| Embedded | QNAP, Synology, OpenWrt, kernel 3.x armv5 · armv7 · arm64 · x86_64 |
C agent, fully static (musl) | Compiled in; nothing to load at runtime | Ghost-Cron; ramdisk-aware install |
| macOS | Apple silicon, Intel arm64 · x86_64 |
C agent | Libraries, or built into the binary | Ghost-Launchd (daemon/agent) · Ghost-Cron |
A claim about detectability is only as good as the method behind it — so AXIS keeps one. Each build is exercised against every tracked engine family in three lanes: static, on-execute, and a post-execution behavioral window, followed by a telemetry review on instrumented hosts. A revision ships when the matrix completes with no blocking verdict. Rev 0328 shipped.
AXIS
/ Search agents… (Ctrl+F)
Field check, 2026-09 — on an instrumented SentinelOne + Defender host, persistence installed and the agent beaconed as SYSTEM while both engines stayed silent. A matrix is a snapshot, not a slogan: the builder matches the delivery family to the watch on each host, and the next revision runs the lanes again.
Fig. — the evaluation lab, redrawn from the licensee material
| AXIS | Cobalt Strike | Brute Ratel | Nighthawk | Mythic (OSS) | |
|---|---|---|---|---|---|
| Full operation from the browser | Yes | — | Yes | Yes | Yes |
| macOS agent | Yes | — | — | — | Yes |
| Embedded / ARMv5 · old-glibc NAS | Yes | — | — | — | — |
| Static musl builds | Yes | — | — | — | — |
| BOF execution | Yes | Yes | Yes | Yes | agent-dep. |
| MSI ghost-stream delivery | Yes | — | — | — | — |
| One-time stager tokens | Yes | — | — | — | — |
| Blockchain C2 recovery (Ghost Chain) | Yes | — | — | — | — |
| Desktop client | Yes | Yes | Yes | Yes | — |
| Scriptable API | REST | Aggressor | Yes | Yes | GraphQL |
| Offline license — zero phone-home | Yes | Yes | — | — | n/a |
| Per-revision AV/EDR evaluation matrix | Yes | — | — | — | — |
| Entry pricing | on request | ≈ $5,900 /user/yr | on request | on request | free |
Capabilities change over time — verify with each vendor.
The platform, feature by feature: the 225 KB agent, the console that is the whole product, the module depot, traffic profiles, delivery, execution, automation, and interoperability.
/02 — SupportInstallation and quickstart, the operator manual, the release train, research notes, opening a case, and renewals — one mailbox, engineers on the other end.
/03 — ResourcesEDR telemetry maps, our BYOVD driver research, annotated release notes, and design doctrine — written to be useful to defenders too.
/04 — AboutWho builds AXIS and why: the doctrine, the engineering rules, the research programs, and the principles we sell by.
Every view on the console page is drawn from the real panel — dashboard, workspace, builder, campaigns, files, tunnels. The license covers the whole platform — teamserver, panel, both agents, every module, the desktop client, the toolchain; source code not included. Evaluation licenses go to qualified teams on request.
Priced on request · one license, whole platform