{
  "name": "psExec",
  "display_name": "psExec",
  "kind": "module",
  "description": "Copy and run a service executable on a remote Windows host. The service executable is resolved from Tools first, then UploadedArtifacts.",
  "command_template": "psExec [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {target:q} {service_artifact:q}",
  "target": "beacon",
  "requires_session": true,
  "platforms": ["windows"],
  "archs": ["x86", "x64", "arm64"],
  "args": [
    {
      "name": "--vault",
      "type": "credential",
      "required": false,
      "description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
      "credential_filter": {
        "type": "password"
      }
    },
    {
      "name": "auth_mode",
      "type": "enum",
      "required": false,
      "description": "Authentication mode.",
      "values": ["-u", "-k", "-n"]
    },
    {
      "name": "username",
      "type": "text",
      "required": false,
      "description": "DOMAIN\\Username for explicit -u mode."
    },
    {
      "name": "password",
      "type": "text",
      "required": false,
      "description": "Password for -u mode."
    },
    {
      "name": "target",
      "type": "text",
      "required": true,
      "description": "Target host name or IP."
    },
    {
      "name": "service_artifact",
      "type": "artifact",
      "required": true,
      "description": "Service executable artifact from Tools or UploadedArtifacts.",
      "artifact_filters": [
        {
          "category": "tool",
          "scope": "server",
          "target": "teamserver",
          "platform": "windows",
          "arch": "session.arch",
          "runtime": "any",
          "name_contains": ".exe"
        },
        {
          "category": "upload",
          "scope": "operator",
          "target": "beacon",
          "platform": "session.platform",
          "arch": "session.arch",
          "runtime": "file",
          "name_contains": ".exe"
        }
      ]
    }
  ],
  "examples": [
    "psExec --vault cred:credentialId fileserver service.exe",
    "psExec -u DOMAIN\\Username Password123! fileserver service.exe",
    "psExec -k fileserver service.exe",
    "psExec -n fileserver service.exe"
  ],
  "source": "manifest"
}