Skip to content

Empire

Software · ATTACK:enterprise:S0363

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0363",
  "title": "Empire",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0363",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--3433a9e8-1c47-4320-b9bf-ed449061d1c3",
  "external_id": "S0363",
  "domain": "enterprise",
  "created": "2019-03-11T14:13:40.648Z",
  "modified": "2025-10-24T03:33:19.777Z",
  "version": "1.8",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "EmPyre"
    },
    {
      "source_name": "PowerShell Empire"
    },
    {
      "source_name": "Github PowerShell Empire",
      "url": "https://github.com/PowerShellEmpire/Empire"
    },
    {
      "source_name": "GitHub ATTACK Empire",
      "url": "https://github.com/dstepanic/attck_empire"
    },
    {
      "source_name": "NCSC Joint Report Public Tools",
      "url": "https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"
    }
  ]
}

Explicit source assertions (91)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03d08c76-d8ce-435a-bac1-9cb77cdbaa0c

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1021.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04878c23-0ba8-4893-acd7-f0594241b66f

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1557.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0537c342-77af-4626-bbe3-9360798a30d5

Github PowerShell Empire · GitHub Inveigh

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07db5f41-fc53-47e6-ae7b-755a4acc9e62

Talos Frankenstein June 2019 · Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--095d2af9-dca4-4a7a-b22e-e37923e7c43c

Github PowerShell Empire · NCSC Joint Report Public Tools

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cc7cd3a-629e-4f90-9fca-1dde823fa428

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14dcdf1b-6788-429d-a7d0-910e86a2e6d6

Github PowerShell Empire

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1567fbd3-5d2b-4040-a736-11f3d5e2139f

Group IB Silence Aug 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16e0be5b-93bb-4db2-b6ed-02e34a6ce3cb

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--187c8a97-3ba1-476e-8377-592adb8e70a3

Github PowerShell Empire

ATTACK:enterprise:G0051 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e809121-085d-419e-a763-c9e2309af074

FireEye FIN10 June 2017

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21c130df-4123-4f57-9ea2-9ceac05af597

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2589342a-8f88-4458-bc34-cec6b073763e

Github PowerShell Empire

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cf01fbd-c940-4152-8173-bae63f37aedd

Talos Frankenstein June 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3237c264-c70c-4fe4-9f53-a8709c3dd006

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32fc949c-2127-425b-9480-6d07ead49982

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1484.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39266465-987d-46f6-8680-4149a5bfea50

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39d1a7ed-2388-4611-9886-915a3604c300

Talos Frankenstein June 2019 · Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c766e53-1372-4b94-b7de-b3f70d4d1a91

Talos Frankenstein June 2019 · Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ca37791-9dad-430f-aee9-0126d13ae932

Github PowerShell Empire

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40848159-b266-42df-9cf8-785b2f78bcfc

ESET Turla August 2018 · ESET Crutch December 2020

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4507ba2b-e23c-4acf-a6a3-5ed9dae8d590

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45608b9a-ddd8-45f9-9152-bed384a1c8c3

Talos Frankenstein June 2019

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--464c9ae2-09b1-499d-8477-c05926537e6b

Lab52 WIRTE Apr 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47899da0-29da-4518-b94a-0f08bc01e5c9

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4be42e8a-4547-43c5-97bf-01440994f95b

Talos Frankenstein June 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1555.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--558132f8-5d0f-4c77-b3a2-b7e9c060a3f5

Empire Keychain Decrypt

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1615

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--563c1b39-f32b-4dfd-b3c1-47fb66ce9eb7

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58b7b9bf-d09b-49f4-acf5-351979171317

Github PowerShell Empire · SecureWorks August 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1547.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b162339-4155-4757-8ec1-11834a613c8a

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5daee125-eb83-4529-889e-18de7115f688

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1558.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f1cf52c-f565-4325-9d4f-4a961c642a0f

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1134.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62785ee1-44c5-4938-a479-3f1546531032

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1574.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63092968-deca-4af9-bda5-a3e05b4db40f

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cc7fc62-740a-47c4-988c-bdd9c5880c3f

Github PowerShell Empire

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d06f2d2-9037-47d6-b374-156a35256097

mandiant_apt44_unearthing_sandworm

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f82c79c-ef15-4625-b2cf-433e2b600f1e

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fa815b2-23dc-455f-b358-dacb4e30a073

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1574.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70386a3a-6ea5-4a2b-9989-2356ee9cf770

Github PowerShell Empire

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--732d754a-b02d-4ec6-8ba2-364c3a8510de

CISA AA21-200A APT40 July 2021

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7367c930-0727-4550-b421-2768edef03cd

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73fbf268-20d3-4549-9dd2-6e20e18079e0

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7447ce8c-6c1a-497e-86d5-1adf960e23a3

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1567.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74779612-4c9b-4b23-8138-763f84362f8f

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75cc19f5-00b4-43e2-8eae-f633693dbe56

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1056.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d349715-69e8-4e3c-bb98-8dc8d3051ca2

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1574.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f0f21db-5bb8-465c-9141-d1b5172d0756

Github PowerShell Empire

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--830ebcfb-58a9-4a11-b319-ca49ce7bfe1b

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8362d7e2-c22a-4bde-99dd-b2d66b4c775a

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8561e826-0aa8-4711-ab0b-fffb0b03ff13

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85dc96ac-ec8e-4e15-ba4b-807c1a7b46cc

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--872c6f1b-aa4f-4d43-b35d-c4216d2f4559

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88427fdf-9d70-49d2-a7ca-4c79ee387d3d

Github PowerShell Empire

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89b157e1-3972-421e-87c9-f9e83b26ec90

NCSC Joint Report Public Tools

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1127.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e21def7-2c70-47f8-90f5-0238048ae15f

Github PowerShell Empire

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8efc016b-af48-4cfd-a117-142a88b7c9d9

Crowdstrike Indrik November 2018

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9741bd7b-a3f2-4052-b2e0-f0fcf331ceae

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98ec1cf2-91ed-4a5f-b653-1d60259d0b46

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9983965f-91b7-492b-9764-ad801af4476a

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bd9e08d-efda-4710-8158-9e915dce16d9

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9be360bb-8ac4-4357-8795-0736b447293c

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c98640e-0307-48bb-aafc-af14a774fd5b

Github PowerShell Empire

ATTACK:enterprise:G0052 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a622b97a-e473-45a5-9e93-85c883f02074

ClearSky Wilted Tulip July 2017

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa83b2a0-9941-461f-b9be-a758315f0c4d

SecureWorks August 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac1cc421-b62d-462a-8d66-bc5de66defa0

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac4e0574-879e-4155-84ed-5b2d8be0b603

Github PowerShell Empire

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4e20afc-56a8-4a05-8f73-076b17e3794e

Crowdstrike GTR2020 Mar 2020

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b97afcfc-489a-4d59-89b3-1533eae926e0

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9b28368-527c-4b13-9350-b2cda637e711

Github PowerShell Empire

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba2b3c40-f9d2-4663-a5bd-3bb158553572

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baec4c99-f8f9-4789-a73d-c6b652299048

TrendMicro POWERSTATS V3 June 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bce07a45-9955-4466-86ad-35fef741087d

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1574.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c17d90b5-569c-42db-9265-ac99cad32093

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c45974f5-90b7-4b5b-8123-9961df8ea26d

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c761f444-3c01-44b4-b8e7-8a26746ce115

Github PowerShell Empire

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3b5af98-ac27-4135-9da6-8e917cc0769d

FireEye APT33 Guardrail · Symantec Elfin Mar 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5edf7fa-6d2b-4af8-a1d3-e0f9fe56eb00

Github PowerShell Empire

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d73c0fd6-cbd9-4eaa-abca-a1626364ab1b

DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e26cfb89-f796-4ba1-bf5c-4084b6479762

Github PowerShell Empire

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1134.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5539e56-e35f-4097-9862-ba26cac35346

Github PowerShell Empire

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.