EmpireTool
- empyre
- PowerShell Empire
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS.From MITRE ATT&CK
Last reported 7 months ago, by ESET WeLiveSecurity (ES)4 reports
ATT&CK techniques
6 of 29 · each with the sentence it comes from- T1001Data Obfuscation
“T1001”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
- T1056Input Capture
“Input Capture: Keylogging”
- T1056.001Keylogging
“T1056.001”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Sednit recargado: un APT histórico reactiva su arsenal“…21 documentada por Trellix, Sednit desplegó dos implants en paralelo: Graphite, que utilizaba OneDrive como canal de C&C, y PowerShell Empire, que dependía de infraestructura dedicada separada.”
-
Sednit reloaded: Back in the trenches“…21 campaign documented by Trellix, Sednit deployed two implants in parallel: Graphite, which used OneDrive as its C&C channel, and PowerShell Empire, which relied on separate dedicated infrastructure.”
-
Hunting For In-Memory .NET Attacks“ReflectivePick allows PowerShell Empire to inject and bootstrap PowerShell into any running process.”
-
REvil Twins: Ransomware-as-a-Service program“…ors use post-exploitation tools in a quite common way, so if you focus on regular command line arguments typical of Cobalt Strike, PowerShell Empire and others, you’ll most likely successfully detect them.”
Indicators in its reports
named in the reports above- d0db619a7a160949…151bf9775c32in 2 reports
- 99b454262dc26b08…82a49d334e5ein 2 reports
- 5603e99151f8803c…4d071542f01bin 2 reports
- 6d39f49aa11ce057…9bae423ce3d5in 2 reports
- exploit[.]inin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.