S0363: Empire

S0363: Empire describes [Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1059/001) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely us...

Executive priority

S0363: Empire is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0363: Empire by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, macOS, Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0363: Empire appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques73 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1125	Video Capture	Empire can capture webcam data on Windows and macOS systems.[2]
Enterprise	T1021.003	Distributed Component Object ModelSub-technique	Empire can utilize `Invoke-DCOM` to leverage remote COM execution for lateral movement.[2]
Enterprise	T1557.001	Name Resolution Poisoning and SMB RelaySub-technique	Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.[2]CitationGitHub Inveigh
Enterprise	T1016	System Network Configuration Discovery	Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.[2]CitationTalos Frankenstein June 2019
Enterprise	T1059.001	PowerShellSub-technique	Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the `Invoke-PSRemoting` module.[2][1]
Enterprise	T1482	Domain Trust Discovery	Empire has modules for enumerating domain trusts.[2]
Enterprise	T1056.001	KeyloggingSub-technique	Empire includes keylogging capabilities for Windows, Linux, and macOS systems.[2]
Enterprise	T1027.010	Command ObfuscationSub-technique	Empire has the ability to obfuscate commands using `Invoke-Obfuscation`.[2]
Enterprise	T1136.001	Local AccountSub-technique	Empire has a module for creating a local user if permissions allow.[2]
Enterprise	T1113	Screen Capture	Empire is capable of capturing screenshots on Windows and macOS systems.[2]
Enterprise	T1046	Network Service Discovery	Empire can perform port scans from an infected host.[2]
Enterprise	T1552.001	Credentials In FilesSub-technique	Empire can use various modules to search for files containing passwords.[2]
Enterprise	T1560	Archive Collected Data	Empire can ZIP directories on the target system.[2]
Enterprise	T1484.001	Group Policy ModificationSub-technique	Empire can use `New-GPOImmediateTask` to modify a GPO that will install and execute a malicious Scheduled Task/Job.[2]
Enterprise	T1041	Exfiltration Over C2 Channel	Empire can send data gathered from a target through the command and control channel.[2]CitationTalos Frankenstein June 2019
Enterprise	T1082	System Information Discovery	Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.[2]CitationTalos Frankenstein June 2019
Enterprise	T1115	Clipboard Data	Empire can harvest clipboard data on both Windows and macOS systems.[2]
Enterprise	T1068	Exploitation for Privilege Escalation	Empire can exploit vulnerabilities such as MS16-032 and MS16-135.[2]
Enterprise	T1020	Automated Exfiltration	Empire has the ability to automatically send collected data back to the threat actors' C2.CitationTalos Frankenstein June 2019
Enterprise	T1546.008	Accessibility FeaturesSub-technique	Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe.[2]
Enterprise	T1119	Automated Collection	Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.CitationTalos Frankenstein June 2019
Enterprise	T1555.001	KeychainSub-technique	Empire uses the command `/usr/bin/security dump-keychain -d` to read the keychain credential.CitationEmpire Keychain Decrypt
Enterprise	T1615	Group Policy Discovery	Empire includes various modules for enumerating Group Policy.[2]
Enterprise	T1087.002	Domain AccountSub-technique	Empire can acquire local and domain user account information.[2]CitationSecureWorks August 2019
Enterprise	T1547.005	Security Support ProviderSub-technique	Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's `Install-SSP` and `Invoke-Mimikatz` to install malicious SSPs and log authentication events.[2]
Enterprise	T1021.004	SSHSub-technique	Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.[2]
Enterprise	T1558.003	KerberoastingSub-technique	Empire uses PowerSploit's `Invoke-Kerberoast` to request service tickets and return crackable ticket hashes.[2]
Enterprise	T1134.005	SID-History InjectionSub-technique	Empire can add a SID-History to a user if on a domain controller.[2]
Enterprise	T1574.009	Path Interception by Unquoted PathSub-technique	Empire contains modules that can discover and exploit unquoted path vulnerabilities.[2]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Empire can modify the registry run keys `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` and `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.[2]
Enterprise	T1135	Network Share Discovery	Empire can find shared drives on the local system.[2]
Enterprise	T1574.008	Path Interception by Search Order HijackingSub-technique	Empire contains modules that can discover and exploit search order hijacking vulnerabilities.[2]
Enterprise	T1558.001	Golden TicketSub-technique	Empire can leverage its implementation of Mimikatz to obtain and use golden tickets.[2]
Enterprise	T1210	Exploitation of Remote Services	Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.[2]
Enterprise	T1569.002	Service ExecutionSub-technique	Empire can use PsExec to execute a payload on a remote host.[2]
Enterprise	T1567.001	Exfiltration to Code RepositorySub-technique	Empire can use GitHub for data exfiltration.[2]
Enterprise	T1083	File and Directory Discovery	Empire includes various modules for finding files of interest on hosts and network shares.[2]
Enterprise	T1056.004	Credential API HookingSub-technique	Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.[2]
Enterprise	T1574.007	Path Interception by PATH Environment VariableSub-technique	Empire contains modules that can discover and exploit path interception opportunities in the PATH environment variable.[2]
Enterprise	T1106	Native API	Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.[2]
Enterprise	T1047	Windows Management Instrumentation	Empire can use WMI to deliver a payload to a remote host.[2]
Enterprise	T1055	Process Injection	Empire contains multiple modules for injecting into processes, such as `Invoke-PSInject`.[2]
Enterprise	T1550.002	Pass the HashSub-technique	Empire can perform pass the hash attacks.[2]
Enterprise	T1217	Browser Information Discovery	Empire has the ability to gather browser data such as bookmarks and visited sites.[2]
Enterprise	T1127.001	MSBuildSub-technique	Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.[2]
Enterprise	T1552.004	Private KeysSub-technique	Empire can use modules like `Invoke-SessionGopher` to extract private key and session information.[2]
Enterprise	T1567.002	Exfiltration to Cloud StorageSub-technique	Empire can use Dropbox for data exfiltration.[2]
Enterprise	T1071.001	Web ProtocolsSub-technique	Empire can conduct command and control over protocols like HTTP and HTTPS.[2]
Enterprise	T1134	Access Token Manipulation	Empire can use PowerSploit's `Invoke-TokenManipulation` to manipulate access tokens.[2]
Enterprise	T1040	Network Sniffing	Empire can be used to conduct packet captures on target hosts.[2]
Enterprise	T1114.001	Local Email CollectionSub-technique	Empire has the ability to collect emails on a target system.[2]
Enterprise	T1059.003	Windows Command ShellSub-technique	Empire has modules for executing scripts.[2]
Enterprise	T1102.002	Bidirectional CommunicationSub-technique	Empire can use Dropbox and GitHub for C2.[2]
Enterprise	T1555.003	Credentials from Web BrowsersSub-technique	Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.[2]
Enterprise	T1518.001	Security Software DiscoverySub-technique	Empire can enumerate antivirus software on the target.[2]
Enterprise	T1087.001	Local AccountSub-technique	Empire can acquire local and domain user account information.[2]
Enterprise	T1574.004	Dylib HijackingSub-technique	Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.[2]
Enterprise	T1049	System Network Connections Discovery	Empire can enumerate the current network connections of a host.[2]
Enterprise	T1053.005	Scheduled TaskSub-technique	Empire has modules to interact with the Windows task scheduler.[2]
Enterprise	T1003.001	LSASS MemorySub-technique	Empire contains an implementation of Mimikatz to gather credentials from memory.[2]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	Empire can use TLS to encrypt its C2 channel.[2]
Enterprise	T1134.002	Create Process with TokenSub-technique	Empire can use `Invoke-RunAs` to make tokens.[2]
Enterprise	T1543.003	Windows ServiceSub-technique	Empire can utilize built-in modules to modify service binaries and restore them to their original state.[2]
Enterprise	T1059	Command and Scripting Interpreter	Empire uses a command-line interface to interact with systems.[2]
Enterprise	T1057	Process Discovery	Empire can find information about processes running on local and remote systems.[2]CitationTalos Frankenstein June 2019
Enterprise	T1105	Ingress Tool Transfer	Empire can upload and download to and from a victim machine.[2]
Enterprise	T1070.006	TimestompSub-technique	Empire can timestomp any files or payloads placed on a target machine to help them blend in.[2]
Enterprise	T1547.009	Shortcut ModificationSub-technique	Empire can persist by modifying a .LNK file to include a backdoor.[2]
Enterprise	T1574.001	DLLSub-technique	Empire contains modules that can discover and exploit various DLL hijacking opportunities.[2]
Enterprise	T1136.002	Domain AccountSub-technique	Empire has a module for creating a new domain user if permissions allow.[2]
Enterprise	T1033	System Owner/User Discovery	Empire can enumerate the username on targeted hosts.CitationTalos Frankenstein June 2019
Enterprise	T1548.002	Bypass User Account ControlSub-technique	Empire includes various modules to attempt to bypass UAC for escalation of privileges.[2]
Enterprise	T1558.002	Silver TicketSub-technique	Empire can leverage its implementation of Mimikatz to obtain and use silver tickets.[2]

Associated objects

Groups, software, and campaigns

G0091: Silence

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.[1][2]

G0051: FIN10

FIN10 is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations. [1]

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

G0090: WIRTE

WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.[1][2][3][4]

G0034: Sandworm Team

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]

G1040: Play

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.[1][2]

C0001: Frankenstein

Frankenstein was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including Empire. The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.8
Created: Mar 11, 2019, 14:13 UTC (UTC+00:00)
Modified: Oct 24, 2025, 03:33 UTC (UTC+00:00)
Raw hash: f6ddcf771a4e5ab2...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.8	Oct 24, 2025, 03:33 UTC (UTC+00:00)	Current bundle	`f6ddcf771a4e…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.8	Oct 24, 2025, 03:33 UTC (UTC+00:00)	Older bundle	`f6ddcf771a4e…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.8	Oct 24, 2025, 03:33 UTC (UTC+00:00)	Older bundle	`f6ddcf771a4e…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
NCSC Joint Report Public Tools
The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
Open source URL
[2]
Github PowerShell Empire
Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
Open source URL
[3]
GitHub ATTACK Empire
Stepanic, D. (2018, September 2). attck_empire: Generate ATT&CK Navigator layer file from PowerShell Empire agent logs. Retrieved March 11, 2019.
Open source URL
[4]
EmPyre
(Citation: Github PowerShell Empire)
[5]
PowerShell Empire
(Citation: Github PowerShell Empire)
[6]
mitre-attackS0363
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use