PowerShell Empire: The Post-Exploitation C2 That APTs Adopted

PowerShell Empire is an open-source, cross-platform post-exploitation and command-and-control framework used by red teams to emulate adversary tradecraft after initial access. It couples a C2 server with lightweight agents and a large module library for credential theft, lateral movement, privilege escalation and collection. Because it ships ready-made offensive capability with encrypted, asynchronous, blend-in C2, it is heavily abused by real intrusion sets — one of a small set of public tools called out by government reporting as widely adopted by adversaries. MITRE ATT&CK tracks it as Software entry S0363 (associated names: PowerShell Empire, EmPyre).

Overview & Lineage

Empire premiered at BSidesLV 2015 from the Veris Group’s Adaptive Threat Division; a Python counterpart, EmPyre, followed in 2016. The original maintainers archived the project in 2019. BC Security forked it, ported the codebase from Python 2 to Python 3 and merged PowerShell Empire and EmPyre into one project. The Windows agent is pure PowerShell; Linux and macOS agents are Python. Starkiller is the official web GUI front end, bundled with the modern Empire server.

Architecture & Capabilities

Empire’s model is listeners → stagers → agents, with adaptable communication profiles and encrypted, asynchronous C2 designed to blend into normal traffic. Reported module families:

• Code execution and in-memory PowerShell, with AMSI-bypass tradecraft. T1059.001 T1055
• Credential dumping via Invoke-Mimikatz and Kerberoasting via Invoke-Kerberoast (requesting SPN service tickets for offline cracking). T1003 T1558.003
• Privilege escalation and bypass-UAC modules. T1548
• Collection: keylogging, screen and packet capture, browser-data theft; lateral movement modules. T1056.001 T1021

Real-World Abuse

Groups documented using Empire for the full post-exploitation chain include Turla, APT19, APT33, APT41, MuddyWater and FIN10. ESET reported Turla using PowerShell loaders for in-memory, disk-avoiding execution of payloads, with samples modified to bypass AMSI. Attribution lists drawn from secondary aggregators should be confirmed against MITRE’s live S0363 “Groups” section.

MITRE ATT&CK Mapping

Detection & Mitigation

• The default launcher pattern invokes PowerShell with the characteristic flags -noP -sta -w 1 -enc followed by a long Base64 blob — a strong but customizable indicator; absence does not clear.
• Enable and centrally collect PowerShell Script Block Logging (Event ID 4104) and Module Logging (4103), which capture deobfuscated script content even when the command line is encoded; enable AMSI and alert on AMSI-bypass patterns.
• Apply Constrained Language Mode and application control (WDAC/AppLocker); alert on wscript.exe spawning PowerShell and on long-lived outbound HTTP beacons with default Empire URIs or user-agents.
• Monitor for Kerberoasting (bursts of TGS-REQ for SPNs) and LSASS access; restrict and tier administrative credentials. Traffic is encrypted and profiles are malleable, so endpoint script-logging beats network-only signatures.