MITRE ATT&CKsoftware (tool)
S0363 Empire
- Domain
- enterprise
- Platforms
- Linux, macOS, Windows
- Aliases
- EmPyre, PowerShell Empire
- Version
- 1.8
- Created
- 2019-03-11
Description
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.
Related
Uses · MITRE ATT&CK (73)
- T1027.010 Command Obfuscation sub-technique
- T1615 Group Policy Discovery technique
- T1484.001 Group Policy Modification sub-technique
- T1127.001 MSBuild sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1574.004 Dylib Hijacking sub-technique
- T1071.001 Web Protocols sub-technique
- T1102.002 Bidirectional Communication sub-technique
- T1574.001 DLL sub-technique
- T1574.007 Path Interception by PATH Environment Variable sub-technique
- T1574.008 Path Interception by Search Order Hijacking sub-technique
- T1574.009 Path Interception by Unquoted Path sub-technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1567.001 Exfiltration to Code Repository sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1560 Archive Collected Data technique
- T1114.001 Local Email Collection sub-technique
- T1134.002 Create Process with Token sub-technique
- T1134.005 SID-History Injection sub-technique
- T1555.001 Keychain sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1003.001 LSASS Memory sub-technique
- T1021.003 Distributed Component Object Model sub-technique
- T1021.004 SSH sub-technique
- T1056.001 Keylogging sub-technique
Referenced by MITRE ATT&CK · uses (18)
- G1040 Play group
- G1016 FIN13 group
- C0001 Frankenstein campaign
- G0140 LazyScripter group
- G0119 Indrik Spider group
- G0102 Wizard Spider group
- G0096 APT41 group
- G0090 WIRTE group
- G0091 Silence group
- G0073 APT19 group
- G1001 HEXANE group
- G0064 APT33 group
- G0065 Leviathan group
- G0069 MuddyWater group
- G0052 CopyKittens group
- G0051 FIN10 group
- G0010 Turla group
- G0034 Sandworm Team group
References
- https://github.com/PowerShellEmpire/Empire Github PowerShell Empire
- https://github.com/dstepanic/attck_empire GitHub ATTACK Empire
- https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools NCSC Joint Report Public Tools