Empire

MITRE

Malware Type:
Tool

First seen:
Unknown

Last seen:
Unknown

Details:

[Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1059/001) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)

Associated Techniques (73)

ID	ATT&CK	Tactics
T1003.001	LSASS Memory	-
T1016	System Network Configuration Discovery	-
T1020	Automated Exfiltration	-
T1021.003	Distributed Component Object Model	-
T1021.004	SSH	-
T1027.010	Command Obfuscation	-
T1033	System Owner/User Discovery	-
T1040	Network Sniffing	-
T1041	Exfiltration Over C2 Channel	-
T1046	Network Service Discovery	-
T1047	Windows Management Instrumentation	-
T1049	System Network Connections Discovery	-
T1053.005	Scheduled Task	-
T1055	Process Injection	-
T1056.001	Keylogging	-

Aliases (210)

EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire EmPyre PowerShell Empire

Used by Actors (17)

APT19
Nation-state

APT33
Nation-state

APT41
Nation-state

CopyKittens
Nation-state

FIN10
Unknown

FIN13
Unknown

HEXANE
Unknown

INDRIK SPIDER
Unknown

LazyScripter
Unknown

Leviathan
Unknown

Metadata

ID:	717
Created:	13/01/2026 17:48
Updated:	06/03/2026 16:00