This page consists of all the potential messages that can appear in the Director interface when an Action is run and results in an error. For ease of navigation, these messages are provided alphabetically and in multiple tabs. Actionable steps to try to address the error are also provided wherever available.
A-F
| Error Code | Description | Debug Message |
|---|---|---|
| action_not_found | Actor could not find action. |
|
| attachment_failure | Failed to upload attachment. |
|
| attacker_not_ready | Source Actor did not respond ready to run action. |
|
| base_smtp_error | Error testing smtp login. Please ensure all values for smtp are correct. |
|
| called_process_error | Failed to execute system command while running port scan. |
|
| cancel_received | Cancel message received from Director. Please try running again. |
|
| cannot_bind_error | Could not bind to socket during file transfer.
|
|
| cannot_find_next_packet | Failed to find next packet while running simulation.
|
|
| cannot_listen_port | Could not listen on specified port, check if port is already in use. |
|
| connection_aborted_error | Failed to connect to Email server. Please verify email settings are correct and try again. |
|
| connection_cannot_listen | Unable to listen on specified connection during file transfer action. |
|
| connection_refused_error | Connection refused. Ensure that actors are able to communicate. | Reboot actors. |
| connection_reset_error | Could not connect, connection was reset. |
|
| connection_socket_error | Could not connect with the socket-server. |
|
| could_not_clear_safe_urls | Error updating use_proxy job settings. |
|
| could_not_determine_os_defined_proxy | Could not determine os defined proxy. Please ensure that your proxy settings are correct and try again. |
|
| could_not_set_to_run_as_captive_ioc_pcap | Error updating run_as_captive_ioc_pcap job settings. |
|
| could_not_start_tunnel_process | Failed to start ssh tunnel. Please try again later. |
|
| could_not_update_urls | Error updating job setting, urls. |
|
| could_not_write_cntlm_config_file | Could not write cntlm config file. |
|
| creating_server | Failed to create HTTP server while running an action. Please try again later. |
|
| credential_provider_not_installed | Credential Provider not found. |
|
| custom_shell_path_already_exists | Custom shell path already exists. Please check your settings and try again. |
|
| data_mismatch | Data received does not match expected data. |
|
| determining_interface | Error checking if interface for simulation is available. Download support logs and provide to Mandiant. |
|
| dns_client_setup_port | Tunnel encountered an error during setup. Ensure that port 0 is not being provided. Download support logs and provide to Mandiant. |
|
| dns_tunnel_already_running | DNS tunnel already running. |
|
| dns_tunnel_client_binary_not_found | DNS tunnel client binary not found. |
|
| dns_tunnel_server_binary_not_found | DNS tunnel server binary not found. |
|
| dns_tunnel_server_process_already_running | DNS tunnel already running. |
|
| docker_build_error | Building the Docker image failed. Please check your settings and try again. |
|
| docker_container_run_failed | Docker container run failed. Please check your settings and try again. |
|
| docker_image_load_error | Failed to load Docker image. |
|
| docker_run_error | Error running script in docker container. |
|
| exception_opening_port | Error occurred while opening ports for action. |
|
| exception_thrown_on_start_tunnel_process | Error starting ssh tunnel service. |
|
| exchange_authorization_error | Failed to login to the Exchange Server. Please check your settings and try again. |
|
| execution_failed | Failed to run OS command. |
|
| execution_failed_due_to_permissions | Execution failed due to permissions. |
|
| exit_code | Command failed with non-zero exit code. |
|
| file_transfer_not_found | Error finding file to send as response or compare. Download support logs and provide to Mandiant. |
|
| function_end | Failed to run Socket action. |
|
G-L
| Error Code | Description | Debug Message |
|---|---|---|
| general_check_error | SMTP login test failed. Please check your settings and try again. |
|
| general_dns_error | General DNS error encountered. Download support logs and provide to Mandiant. |
|
| general_error | An unknown error occurred while running an action. Please check your settings and try again. If you continue to see this error, please contact support. |
|
| general_exception | An unknown error occurred while running an action. Please check your settings and try again. If you continue to see this error, please contact support. |
|
| general_gmail_error | An unknown error occurred while attempting to check the Gmail Server. Please check your settings and try again. |
|
| general_imap_error | An unknown error occurred while attempting to check the IMAP Server. Please check your settings and try again. |
|
| general_job_exception | General job error encountered. Download support logs and provide to Mandiant. |
|
| general_overall_exception | General error encountered. Download support logs and provide to Mandiant |
|
| general_pop3_error | An unknown error occurred while attempting to check the POP3 Server. Please check your settings and try again. |
|
| general_port_scan_error | General port scan error. Download support logs and provide to Mandiant. |
|
| general_process_error | General process error encountered. Download support logs and provide to Mandiant. | Reboot actors. |
| general_process_exception | General process error encountered. Download support logs and provide to Mandiant. |
|
| general_process_timeout | General process timeout error encountered. Check actor logs for information. | Reboot actors. |
| general_request_error | General request error encountered while attempting to make an http request for a file transfer action. Download support logs and provide to Mandiant. |
|
| general_run_action | General run action error encountered. Download support logs and provide to Mandiant. | Reboot actors. |
| general_run_exception | General run error encountered. Download support logs and provide to Mandiant. | Reboot actors. |
| general_run_simulation_exception | General run simulation error encountered. Download support logs and provide to Mandiant. | Reboot actors. |
| general_runtime_exception | General runtime error encountered while attempting to run a file transfer action. Download support logs and provide to Mandiant. |
|
| general_send_error | General email send error encountered. Download support logs and provide to Mandiant. |
|
| general_sim_error | General run simulation error encountered. Download support logs and provide to Mandiant. |
|
| general_smtp_error | General SMTP error encountered. SMTP login test failed. Please check your settings and try again. |
|
| general_socket_error | General socket error encountered. Download support logs and provide to Mandiant. |
|
| general_target_exception | General target error encountered. Download support logs and provide to Mandiant. | Reboot actors. |
| get_index_not_file | Error occurred while opening ports for socket | Reboot actors. |
| gmail_authorization_error | Failed to login to the Gmail Server. Please check your settings and try again. |
|
| http_authentication_failed | HTTP authentication required. Please check your settings and try again. |
|
| http_error | HTTP error encountered. Please check your settings and try again. |
|
| icmp_tunnel_is_already_running | Hans ICMP tunnel already running. |
|
| imap_abort_error | IMAP server error encountered. Please check your settings and try again. |
|
| imap_general_error | IMAP error encountered. Download support logs and provide to Mandiant. |
|
| imap_login_failed | IMAP login failed. Please check your settings and try again. |
|
| imap_socket_timeout | IMAP socket timeout. Please try again later. |
|
| interface_not_available | Interface for simulation is not up. Check that interfaces for actors are online. |
|
| invalid_action_definition | Hex file not found for Captive DNS Action. Download support logs and provide to Mandiant. |
|
| invalid_action_type | Invalid action type passed to actor. Download support logs and provide to Mandiant. |
|
| invalid_data_read | A file in the Job contained invalid data. If you were running a Protected Theater Action, the malware may have encrypted the file. Check logs for more information. | Mandiant critical files were unable to be read during job. Checklogs for more information. |
| invalid_file_no_content | A file was blank, possibly caused by a permissions issue or unexpected activity. Review the logs for more information. | Actor had no content in a job data file. Check logs for more information. |
| invalid_request | Error encountered while running web request action. Request is not in proper format. Please check your settings and try again. |
|
| invalid_scan_type | Invalid scan type passed to actor. Download support logs and provide to Mandiant. |
|
| invalid_url_request | Invalid URL while attempting to make an HTTP request. Please check your settings and try again. |
|
| invalid_user_profile | Invalid user profile, user not found. Please check your settings and try again. |
|
| job_action_not_found | Exception finding Job Action. Try running job again. |
|
| job_not_found | Job was not found on actor. Download support logs and provide to Mandiant. |
|
| job_setup_error | Error found with job definition. Download support logs and provide to Mandiant. |
|
| job_setup_error:0 | General exception setting up job. See the actor logs for more details. |
|
| job_setup_error:1 | Action execution reached the timeout limit after multiple attempts. |
|
| kerberos_header_error | Kerberos Header Exception. Please check your settings and try again. |
|
| kerberos_server_not_found | Server not found in Kerberos database. Please check your settings and try again. |
|
| kerberos_ticket_error | Error encountered with Kerberos ticket. Please check your settings and try again. |
|
| logging_setup_error | Error encountered while preparing log file handler. |
|
M-R
| Error Code | Description | Debug Message |
|---|---|---|
| mac_not_found | Could not determine MAC Address for gateway. |
|
| md5_file_compare_mismatch | Error occurred while transferring file. |
|
| message_creation_failure | Failed to create email message. Please check your settings and try again. |
|
| mismatched_prompt | Command timed out or expected prompt not found. |
|
| missing_result | There was an error executing script. Please check your settings and try again. |
|
| missing_results | There was an error executing script. Please check your settings and try again. |
|
| multiple_connections_made | Multiple connections made. |
|
| no_conditions_matched | No conditions matched. |
|
| no_data_found | No data found during action. |
|
| no_ip_address_detected_for_tunnel_interface | No IP address detected for tunnel interface. Please check your settings and try again. |
|
| no_nameservers | Source actor was not able to find any nameservers to use. Please make sure that source actor is using a valid DNS server. |
|
| no_target_result | Status not received from target actor. |
|
| no_tunnel_interfaces_detected | No tunnel interfaces detected. |
|
| not_found_in_db | Exception finding action in actor. Try running action again. |
|
| not_found_in_db_job | Exception finding job in actor. Try running job again. |
|
| not_found_in_db_job_action | Exception finding job action in actor. Try running job again. |
|
| not_found_in_job_database | Exception finding Job. Try running job again. |
|
| open_port | Error occurred while opening ports for website. |
|
| opening_port | Error occurred while opening ports for action. |
|
| parsing_action_parameters | Error occurred while parsing action parameters. |
|
| parsing_job_parameters | Error occurred while parsing job parameters. |
|
| parsing_job_settings | Error occurred while parsing job settings. |
|
| parsing_node_settings | Error occurred while parsing actor settings. |
|
| pcap_queue_error | Error occurred while getting next pcap from queue. |
|
| pcap_read_error | Error occurred while actor was reading PCAP. | Reboot Actors. Reload pcap to director as a new action. |
| permission_denied | Permission denied. Please check your settings and try again. |
|
| pop3_retrieval_error | Invalid POP3 response is received. Please try again. |
|
| pop3_socket_timeout | POP3 socket timeout. Please try again later. |
|
| port_already_in_use | A port was unable to be reserved during port scan. Port was already in use. | Ensure that another service is not using a port being scanned. Reboot actors. |
| process_as_user_failed_start | Error occurred while starting a process as user. | Please check user profile credentials |
| prompt_error | Cli prompt expect exception. Please try again later. |
|
| prompt_not_found_on_cli_launch | Prompt not found on cli launch. Please check your settings and try again. |
|
| proxy_authentication_failed | Proxy authentication failed. Please check your settings and try again. |
|
| proxy_cant_connect | Proxy connection refused. Please check your settings and try again. |
|
| proxy_connection_failed | Proxy connection failed. Please check your settings and try again. |
|
| proxy_connection_failed_ssl | Proxy connection failed ssl. Please check your settings and try again. |
|
| proxy_connection_refused | Proxy connection refused. Please check your settings and try again. |
|
| proxy_connection_timeout | Proxy connection timeout. Please check your settings and try again. |
|
| reactor_error | Error while attempting to send file. Please check your settings and try again. |
|
| ready_action_error | Indicates attacker could not determine if target actor was ready for the action. |
|
| receive_errored | Exception running packet receive. |
|
| receiving_response | Error encountered while attempting to receive response from socket. Please try again later. |
|
| relay_dns_server_error | Actor was unable to start a DNS Tunnel for use in the action. |
|
| request_exception | Encountered request exception. |
|
| run_as_user_prep_failed | Encountered an error while preparing database for action run as user. |
|
| run_command_general_error | General error encountered while attempting to run a command. Download support logs and provide to Mandiant. |
|
| run_ftp_client | Error encountered while attempting to run FTP client. Please check your settings and try again. |
|
| run_scp_client | Error encountered while attempting to run SCP client. Please check your settings and try again. |
|
S-Z
| Error Code | Description | Debug Message |
|---|---|---|
| saml_authentication_failed | Error encountered while attempting to generate saml requests data. Please check your settings and try again. |
|
| saving_final_update | Error saving final update to database. Check actor logs for more information. |
|
| script_exception | Error encountered while attempting to run cloud action script. Please check your settings and try again. |
|
| script_timeout | Cloud action script timeout. Please check your settings and try again. |
|
| send_and_receive_errored | Exception running packet receive. Download support logs and provide to Mandiant. |
|
| sending_packet | Exception running packet send. Download support logs and provide to Mandiant. |
|
| sending_request | Exception while attempting to send HTTP request. |
|
| server_error | Proxy server error. Please check your settings and try again. |
|
| sim_runner_not_started | Sim runner failed to initialize connection with Sim Manager. |
|
| simulation_interface_not_up | Interface for simulation is not up on actor. Restart actor and ensure simulation interface is online. |
|
| smtp_authentication_error | SMTP authentication error. Please check your settings and try again. |
|
| smtp_command_not_supported_error | Smtp command not supported error. The command or option is not supported by the SMTP server. Please check your settings and try again. |
|
| smtp_connect_error | Smtp connect error. Error during connection establishment. Please check your settings and try again. |
|
| smtp_disconnected_error | Not connected to any SMTP server. Please check your settings and try again. |
|
| smtp_helo_refused_error | The SMTP server connection failed. The server refused our HELO reply. Please check your settings and try again. |
|
| smtp_recipient_refused_error | SMTP recipient refused error. All recipient addresses refused. Please check your settings and try again. |
|
| smtp_refused_data_error | The SMTP server didn't accept the data. Please check your settings and try again. |
|
| smtp_response_code_error | SMTP server error. Please check your settings and try again. |
|
| smtp_sender_refused_error | SMPT sender address refused. Please check your settings and try again. |
|
| smtp_socket_timeout | Socket timeout occurred while attempting to connect to SMTP server. Please check your settings and try again. |
|
| socket_closed | Socket closed. Download support logs and provide to Mandiant. |
|
| ssh_tunnel_is_already_running | Ssh tunnel is already running. |
|
| ssl_cert_not_found | Could not find certificate file on actor. Try restarting the actor and running the action again. Download support logs and provide to Mandiant. |
|
| ssl_certificate_verification_failed | SSL Error, certificate verify failed. |
|
| ssl_connection_failed | SSL connection failed. |
|
| ssl_general_failure | General SSL error encountered. Download support logs and provide to Mandiant. |
|
| success_and_block_conditions_not_matched | Success and blocked conditions checked, no matches. |
|
| target_not_ready | Destination Actor did not respond ready to run action. Ensure actor is not queued with other actions and able to be reached from director. |
|
| tcp_stack_receive_errored: | Exception running packet receive (tcp_stack). |
|
| timeout | Timeout occurred. | Ensure that actors are able to communicate. Reboot actors. |
| too_many_redirects | Too many redirects. |
|
| tunnel_client_process_not_started | Unable to start DNS tunnel client (process not running). |
|
| tunnel_closed_before_data_sent | Tunnel died between setup and send request. |
|
| tunnel_closed_during_transmission | Tunnel connection was closed during transmission while running file transfer action. |
|
| udp_retry_receive_errore | Exception running packet receive (udp_retry). |
|
| unable_to_bind_to_interface | Unable to bind to interface. |
|
| unable_to_determine_auto_interface | Unable to determine auto interface. |
|
| unable_to_get_user_session | Exception attempting to get User token. |
|
| unable_to_load_file | The Actor was unable to load a file. Check logs for additional information and contact support for assistance. | Actor was unable to load job related files. Check logs for more information. |
| unable_to_parse_settings | Unable to parse email settings file. |
|
| unable_to_resolve_fqdn | Unable to resolve FQDN. |
|
| unable_to_retrieve_results | Unable to retrieve results. |
|
| unexpected_error | Unexpected error running cloud action v2. |
|
| unexpected_source | Unexpected source error occurred while running DNS action. |
|
| unhandled_host_cli_exception | Error encountered while attempting to run host CLI action. Check logs for additional information and contact support for assistance. |
|
| unknown_error | Unknown error occurred while running file transfer. |
|
| unknown_server_type | Unknown email server type. Please check your settings and try again. |
|
| unkown_issue | Unknown error encountered while attempting to run action. Download support logs and provide to Mandiant. |
|
| unsupported_action_macos | Cannot run ssh/scp file transfer target on MacOS. |
|
| unsupported_app_layer | Currently only support http in requests. Please check your settings and try again. |
|
| updating_action_result | Saving Job Action status error. Download support logs and provide to Mandiant. |
|
| updating_initial_status | Exception during initial update of job status. Download support logs and provide to Mandiant. |
|
| user_desktop_not_available | Unable to confirm user desktop has loaded. Please check your settings and try again. |
|
| user_profile_login_failed | User profile login failed. Please check your settings and try again. |
|
| v1_cloud_action_not_supported | V1 cloud action not supported. |
|
| virtual_network_configuration_not_updated | Unable to find or match an MD5 value while trying to verify the Virtual Network configuration. |
|
| virtual_network_configuration_verification_failed | MD5 key not found in status results while trying to verify the Virtual Network configuration. |
|
| virtual_network_dhcp_not_running | DHCP not running while trying to verify the Virtual Network configuration. |
|
| virtual_network_service_and_dhcp_not_running | Virtual Network Service and DHCP not running while trying to verify the Virtual Network configuration. |
|
| virtual_network_service_not_running | Virtual Network service not running. Download support logs and provide to Mandiant. |
|
| virtual_network_status_exception | Virtual Network status general exception while trying to verify the Virtual Network configuration. |
|
| virtual_network_status_timeout | Virtual Network status timeout exception while trying to verify the Virtual Network configuration. |
|