A recurring theme in this series is "the right tool for the situation." Nowhere is that more literal than execution. Cyllex offers three ways to run a technique, and the choice is driven by engagement scope and the footprint you're allowed to leave.
The Agent — When You Need Depth
A lightweight, cross-platform Rust agent (Windows and Linux) for when you need persistent access and richer techniques: beaconing, interactive shell, file upload/download, and multi-step chains. It's the closest thing to a real implant in the kill chain, and the right choice when you're emulating post-exploitation depth rather than a quick check.
Agentless — When You Need a Whisper
Sometimes you just want to validate one detection without dropping a binary. Agentless mode runs techniques over WinRM (Windows) or SSH (Linux) — both handled natively in Rust, with no plink or sshpass to install. Minimal footprint, no persistence, ideal for reconnaissance-style checks and tightly scoped tests.
Cloud-Local — When There Is No Host
Covered in Part 3: cloud techniques run from the server against the provider APIs. No agent, no remote host — just credentials and the provider's control/identity plane.
Instant Agent Generation
When you do want an agent, you shouldn't wait on a compiler. Cyllex generates configured agents by binary patching — the server embeds pre-built templates and stamps in your C2 URL, sleep and jitter in under a second. No Rust toolchain on the deployment server, no per-build wait. Configure, download, deploy.
Campaigns Tie It Together
Execution mode is a per-campaign choice. A campaign bundles the techniques, the targets, and an execution profile — sequential, phased, or parallel — so you can model anything from a single detection check to a full multi-stage intrusion. Campaigns can also be scheduled, one-off or recurring, so regular assessments run themselves.
Whatever mode you choose, the back half is identical: the run feeds straight into the detection-validation loop. Execution is just how you get there.
Next in the series
Part 5: Threat-Informed Defense — emulating real APT playbooks.