Warn user about improper flag usage.

client/command/alias/load.go

@@ -289,9 +289,17 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		// Groupping the two conditions together could crash the client since ctx.Flags.Type panics
 		// if the flag is not registered.
 		if aliasManifest.IsAssembly {
-			if !ctx.Flags.Bool("in-process") {
+			inProcess := ctx.Flags.Bool("in-process")
+			runtime := ctx.Flags.String("runtime")
+			amsiBypass := ctx.Flags.Bool("amsi-bypass")
+			etwBypass := ctx.Flags.Bool("etw-bypass")
+			if !inProcess {
 				msgStr = " Arguments are limited to 256 characters when using the default fork/exec model for .NET assemblies.\nConsider using the --in-process flag to execute .NET assemblies in-process and work around this limitation.\n"
 			}
+			if !inProcess && (runtime != "" || etwBypass || amsiBypass) {
+				con.PrintErrorf("The --runtime, --etw-bypass, and --amsi-bypass flags can only be used with the --in-process flag\n")
+				return
+			}
 		} else if !aliasManifest.IsReflective {
 			msgStr = " Arguments are limited to 256 characters when using the default fork/exec model for non-reflective PE payloads.\n"
 		}

client/command/exec/execute-assembly.go

@@ -66,6 +66,11 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	etwBypass := ctx.Flags.Bool("etw-bypass")
 	amsiBypass := ctx.Flags.Bool("amsi-bypass")
 
+	if !inProcess && (runtime != "" || etwBypass || amsiBypass) {
+		con.PrintErrorf("The --runtime, --etw-bypass, and --amsi-bypass flags can only be used with the --in-process flag\n")
+		return
+	}
+
 	assemblyArgsStr := strings.Join(assemblyArgs, " ")
 	assemblyArgsStr = strings.TrimSpace(assemblyArgsStr)
 	if len(assemblyArgsStr) > 256 && !inProcess {