MITRE ATT&CK Tool

Empire (S0363)

EmPyrePowerShell Empire

ShareX LinkedIn Reddit HN

[Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1059/001) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)

Platforms: Linux, macOS, Windows

▪Techniques implemented (73)

T1125Video Capture T1021.003Distributed Component Object Model T1557.001Name Resolution Poisoning and SMB Relay T1016System Network Configuration Discovery T1059.001PowerShell T1482Domain Trust Discovery T1056.001Keylogging T1027.010Command Obfuscation T1136.001Local Account T1113Screen Capture T1046Network Service Discovery T1552.001Credentials In Files T1560Archive Collected Data T1484.001Group Policy Modification T1041Exfiltration Over C2 Channel T1082System Information Discovery T1115Clipboard Data T1068Exploitation for Privilege Escalation T1020Automated Exfiltration T1546.008Accessibility Features T1119Automated Collection T1555.001Keychain T1615Group Policy Discovery T1087.002Domain Account T1547.005Security Support Provider T1021.004SSH T1558.003Kerberoasting T1134.005SID-History Injection T1574.009Path Interception by Unquoted Path T1547.001Registry Run Keys / Startup Folder T1135Network Share Discovery T1574.008Path Interception by Search Order Hijacking T1558.001Golden Ticket T1210Exploitation of Remote Services T1569.002Service Execution T1567.001Exfiltration to Code Repository T1083File and Directory Discovery T1056.004Credential API Hooking T1574.007Path Interception by PATH Environment Variable T1106Native API T1047Windows Management Instrumentation T1055Process Injection T1550.002Pass the Hash T1217Browser Information Discovery T1127.001MSBuild T1552.004Private Keys T1567.002Exfiltration to Cloud Storage T1071.001Web Protocols T1134Access Token Manipulation T1040Network Sniffing T1114.001Local Email Collection T1059.003Windows Command Shell T1102.002Bidirectional Communication T1555.003Credentials from Web Browsers T1518.001Security Software Discovery T1087.001Local Account T1574.004Dylib Hijacking T1049System Network Connections Discovery T1053.005Scheduled Task T1003.001LSASS Memory T1573.002Asymmetric Cryptography T1134.002Create Process with Token T1543.003Windows Service T1059Command and Scripting Interpreter T1057Process Discovery T1105Ingress Tool Transfer T1070.006Timestomp T1547.009Shortcut Modification T1574.001DLL T1136.002Domain Account T1033System Owner/User Discovery T1548.002Bypass User Account Control T1558.002Silver Ticket

▪Used by groups (17)

G0091Silence G0051FIN10 G0010Turla G0090WIRTE G0034Sandworm Team G1040Play G0065Leviathan G1016FIN13 G0073APT19 G0119Indrik Spider G0052CopyKittens G1001HEXANE G0096APT41 G0140LazyScripter G0069MuddyWater G0064APT33 G0102Wizard Spider

S0363on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.