Procedure examples

Empire contains an implementation of Mimikatz to gather credentials from memory.

Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.

Empire has the ability to automatically send collected data back to the threat actors' C2.

Empire can utilize Invoke-DCOM to leverage remote COM execution for lateral movement.

Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.

Empire has the ability to obfuscate commands using Invoke-Obfuscation.

Empire can enumerate the username on targeted hosts.

Empire can be used to conduct packet captures on target hosts.

Empire can send data gathered from a target through the command and control channel.

Empire can perform port scans from an infected host.

Empire can use WMI to deliver a payload to a remote host.

Empire can enumerate the current network connections of a host.

Empire has modules to interact with the Windows task scheduler.

Empire contains multiple modules for injecting into processes, such as Invoke-PSInject.

Empire includes keylogging capabilities for Windows, Linux, and macOS systems.

Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.

Empire can find information about processes running on local and remote systems.

Empire uses a command-line interface to interact with systems.

Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.

Empire has modules for executing scripts.

Empire can exploit vulnerabilities such as MS16-032 and MS16-135.

Empire can timestomp any files or payloads placed on a target machine to help them blend in.

Empire can conduct command and control over protocols like HTTP and HTTPS.

Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.

Empire includes various modules for finding files of interest on hosts and network shares.

Empire can acquire local and domain user account information.

Empire can acquire local and domain user account information.

Empire can use Dropbox and GitHub for C2.

Empire can upload and download to and from a victim machine.

Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.

Empire is capable of capturing screenshots on Windows and macOS systems.

Empire has the ability to collect emails on a target system.

Empire can harvest clipboard data on both Windows and macOS systems.

Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.

Empire can capture webcam data on Windows and macOS systems.

Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.

Empire can use PowerSploit's Invoke-TokenManipulation to manipulate access tokens.

Empire can use Invoke-RunAs to make tokens.

Empire can add a SID-History to a user if on a domain controller.

Empire can find shared drives on the local system.

Empire has a module for creating a local user if permissions allow.

Empire has a module for creating a new domain user if permissions allow.

Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.

Empire has the ability to gather browser data such as bookmarks and visited sites.

Empire has modules for enumerating domain trusts.

Empire can use New-GPOImmediateTask to modify a GPO that will install and execute a malicious Scheduled Task/Job.

Empire can enumerate antivirus software on the target.

Empire can utilize built-in modules to modify service binaries and restore them to their original state.

Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe.

Empire can modify the registry run keys HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for persistence.