Skip to main content

​
Overview

The job command provides a management interface for the Demon agent’s multi-threaded job system. Jobs are long-running tasks that execute in separate threads, such as BOF executions, SOCKS proxies, and port forwards.

​
Syntax

​
Subcommands

​
list

Displays all currently running jobs with their status and metadata.
​
integer
Unique identifier for the job
​
string
Current job status: Running, Suspended, or Completed
​
string
Type of job (BOF, SOCKS, PortForward, etc.)

​
suspend

Suspends a running job thread without terminating it.
​
integer
required
The ID of the job to suspend (obtained from job list)

​
resume

Resumes a previously suspended job thread.
​
integer
required
The ID of the suspended job to resume

​
kill

Terminates a running or suspended job and removes it from the job list.
​
integer
required
The ID of the job to terminate

​
Examples

​
List All Jobs

Example Output:

​
Suspend a Running Job

Temporarily pauses job 1 without terminating it.

​
Resume a Suspended Job

Restarts job 3 that was previously suspended.

​
Kill a Job

Terminates and removes job 2 from the job list.

​
OPSEC Considerations

Long-running jobs PREVENT sleep obfuscation from occurring. Sleep masking only activates when there are no active job threads.

​
Job Thread Impact on Sleep Obfuscation

When jobs are running:
  • Sleep obfuscation is disabled: The agent cannot encrypt its memory while other threads are active
  • Memory footprint increases: Each job thread maintains its own stack and resources
  • Detection risk: Multiple threads may be more visible to EDR solutions

​
Best Practices

  1. Minimize Job Count: Only run necessary jobs to reduce the agent’s footprint
  2. Kill Completed Jobs: Use job kill to remove finished jobs and allow sleep obfuscation
  3. Monitor Job Status: Regularly check job list to identify hung or unnecessary jobs
  4. Suspend Instead of Kill: Use suspend for jobs you may need later to avoid re-initialization overhead

​
Use Cases

​
Managing SOCKS Proxies

​
Controlling BOF Execution

​
Troubleshooting Hung Jobs

​
Job States

The job thread is actively executing. This state:
  • Prevents sleep obfuscation
  • Consumes CPU and memory resources
  • Can be suspended or killed

​
Return Values

​
string
The job command that was executed (list, suspend, resume, kill)
​
integer
ID of the affected job (not present for list command)
​
string
Result of the operation: Success or Error
​
string
Additional information about the operation result
  • inline-execute - Execute BOFs that create jobs
  • socket - Manage SOCKS proxies and port forwards (creates jobs)
  • dotnet inline-execute - Run .NET assemblies in-process (creates CLR job)

​
Notes

  • Job IDs are assigned sequentially starting from 1
  • Suspended jobs still occupy memory and prevent sleep obfuscation
  • Some job types cannot be safely suspended (e.g., SOCKS connections)
  • Always kill jobs when they are no longer needed to enable sleep obfuscation
  • The agent automatically reports when jobs die unexpectedly