powershell-empire

No entries match these filters. Clear filters

1. docs update Sep 9, 2026 · issue 069

   ./ps-empire update adds a one-step command to refresh Empire source, Starkiller, compiler, and plugin registries

   ⤢ ⤢ ⤢ ⤢
   └──▷ TRY IT
   Keep a production Empire instance fully up to date in a CI/automation pipeline without manual confirmation prompts.
   copy

   $ ./ps-empire update -y

   • Adds ./ps-empire update -y flag to auto-confirm all cache-migration and database-migration prompts for non-interactive/CI use.
   • Supports user-local config overrides via ~/.config/empire/config.user.yaml, which the server merges on top of the base ~/.config/empire/config.yaml at startup, preventing overrides from being lost on update.
   • Clarifies that CertPath for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. listeners is a directory containing empire-chain.pem and empire-priv.key, with a self-signed pair generated in ~/.local/share/empire/cert/ on first server start.
   • Adds ./ps-empire update -y flag to auto-confirm all cache-migration and database-migration prompts for non-interactive/CI use.
   • Supports user-local config overrides via ~/.config/empire/config.user.yaml, which the server merges on top of the base ~/.config/empire/config.yaml at startup, preventing overrides from being lost on update.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !./ps-empire update overwrites ~/.config/empire/config.yaml with the shipped template on every run — any edits made directly to that file will be lost; move local customizations to ~/.config/empire/config.user.yaml before upgrading.
   • !Empire 7.0 replaced bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. password hashing with PBKDF2-HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it., making pre-7.0 password hashes unusable; a fresh database (--reset) is required — there is no in-place upgrade path from 6.x.
   • !Earlier installs that ran ./ps-empire install under sudo left ~/.config/empire/ and ~/.local/share/empire/ root-owned; update aborts if it detects this — fix with sudo chown -R "$USER" ~/.config/empire ~/.local/share/empire.
2. v7.0.2 Sep 8, 2026 · issue 070

   Empire v7 adds 30+ BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. modules, AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption., chunked uploads, persistent chdir, and a new ps-empire update subcommand⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v7.0.2 https://github.com/BC-SECURITY/Empire.git
   # already have the repo? check out this version:
   $ git checkout v7.0.2

   └──▷ TRY IT
   Upgrade an Empire server to the latest release, automatically confirming the database backup prompt and applying any pending schema migrations.
   copy

   $ ./ps-empire update -y

   Serve an already-built Starkiller from a local directory for an air-gapped install, bypassing the GitHub clone step at startup.
   config.user.yaml copy

   starkiller:
     directory: /opt/starkiller/dist

   • Adds ./ps-empire update subcommand that moves the checkout to the latest release tag, refreshes config.yaml, fast-forwards Starkiller, the plugin registry, and the Empire Compiler binary, and applies pending Alembic migrations; use -y to auto-confirm the backup prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds starkiller.directory config option to serve an already-built Starkiller instead of cloning from GitHub, enabling air-gapped and distro-packaged installs.
   • Adds POST /api/v2/agents/{id}/tasks/chdir endpoint and TASK_CHDIR (opcode 44) for persistently changing an agent's working directory across PowerShell, Python, and IronPython agents.
   • Adds chunked file uploads to agents — files split into 512KB chunks drip-fed across checkins — removing the previous 1MB upload limit with backward-compatible protocol detection.
   • Adds AES-256-GCM across the stack: an AES256GCM AEAD class in encryption.py (server), agent/stagers/common/aesgcm.py for Python/IronPython stagers, and a .NET 4.x AesGcmHelper for PowerShell stagers.

   +45 more show less

   • Adds MergeReferences option to the C# module YAML schema, enabling ILRepack dependency merging via the Empire Compiler --merge-references flag.
   • Adds InjectSelf option (default true) to inject_amsi_bypass and inject_etw_bypass — set false to target a remote PID instead of the agent's own process.
   • Adds SafeChecksPS / SafeChecksPython bypass YAMLs consolidating bypass snippets; opt in via a stager's Bypasses parameter.
   • Adds parser support for the Cobalt Strike http-config block in malleable HTTP listeners, wiring trust_x_forwarded_for (default false) and block_useragents (fnmatch globs).
   • Adds a krb_session_key credential type storing Rubeus session keys as <keytype>:<base64key>, captured from both dump and asktgt/asktgs output.
   • Adds a per-option format_string override and {{ VALUE_ARRAY }} token for rendering PowerShell [Array] parameters as double-quoted, comma-joined elements.
   • Adds AFTER_CHAT_MESSAGE_HOOK core hook fired with (db, message: ChatMessage) after a chat message is persisted, enabling plugins to observe chat traffic.
   • Adds a downloadable chatlog report via report=chat (included in report=all), exporting chatlog.csv; chat is now persisted to a new chat_messages table (Alembic migration 0003) and chat/history returns the most recent 20 messages.
   • Adds an Inveigh credential parser (situational_awareness/host/inveigh) that ingests NetNTLMv1/v2 hashes from task output, tagging machine accounts as inveigh machine_account.
   • Adds SharpHound C# module for BloodHound Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enumeration with ILRepack assembly merging.
   • Adds situational-awareness modules powershell/situational_awareness/host/{processes,ipconfig,route,dir_list} and python/situational_awareness/host/processes, emitting JSON for server-side filters.
   • Adds wdtoggle BOF module to patch WDigest/Credential Guard in LSASS to re-enable plaintext credential caching.
   • Adds psx BOF module for a process list annotated with detected security products (AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./logging tools).
   • Adds psm BOF module for detailed single-process info by PID — loaded modules, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections, and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sessions.
   • Adds psk BOF module to enumerate loaded kernel modules/drivers annotated with security-product driver detection.
   • Adds psw BOF module to enumerate window titles across running processes.
   • Adds psc BOF module for a process list with active TCP connections and RDP session details.
   • Adds winver BOF module to retrieve Windows version, build number, and patch revision of the target host.
   • Adds netuse_add, netuse_list, and netuse_delete BOF modules for mapping shares, enumerating connections, and disconnecting mapped drives.
   • Adds sc_enum BOF module to bulk-enumerate all services on a local or remote host via SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. (config, query, failure, and trigger data).
   • Adds sc_qc BOF module to query a Windows service's configuration (binary path, start type, account, dependencies) via SCM.
   • Adds sc_qdescription BOF module to query a Windows service's description via SCM.
   • Adds sc_qfailure BOF module to query a Windows service's failure actions (restart, run command, reboot) via SCM.
   • Adds sc_qtriggerinfo BOF module to query the trigger events that start or stop a Windows service.
   • Adds netuserenum BOF module to enumerate local or domain user accounts via NetUserEnum with a configurable filter.
   • Adds nslookup BOF module for DNS lookups via the Windows DNS client API, with optional custom server and record type.
   • Adds notepad BOF module to enumerate open Notepad/Notepad++ windows and extract the displayed file path or in-memory text.
   • Adds findLoadedModule BOF module to enumerate processes that have a given module (DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. substring) loaded — useful for locating injection targets and fingerprinting EDR.
   • Adds vssenum BOF module to enumerate Volume Shadow Copies exposed on a host's SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. share, useful for locating offline SAM/SYSTEM/NTDS hives.
   • Adds addmachineaccount BOF module for adding machine accounts (lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.).
   • Adds nonpaged_ldapsearch BOF module for synchronous non-paged LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. queries against a domain controller, useful when paged queries are throttled.
   • Adds ldapsearch BOF module for LDAP/LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. queries against a domain controller with configurable scope.
   • Adds reg_query BOF module for in-agent Windows registry queries — key enumeration, value lookup, and recursive traversal — on local or remote systems.
   • Adds etw_patching BOF module to patch or revert EtwEventWrite in ntdll to degrade ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. logging in-process.
   • Adds static_syscalls_dump BOF module to dump a target process's memory via static syscall numbers, bypassing ntdll hooks.
   • Adds static_syscalls_inject BOF module to inject shellcode into a remote process via static syscalls.
   • Adds static_syscalls_apc_spawn BOF module to spawn a temporary process and inject shellcode via APC queue using static syscalls.
   • Adds syscalls_shellcode_injection BOF module to inject shellcode into a remote process via direct syscalls.
   • Adds reconad BOF module for ADSI-based Active Directory reconnaissance.
   • Adds domaininfo BOF module to report AD domain membership and Azure AD join status of the host.
   • Adds smbinfo BOF module to retrieve SMB server info via NetServerGetInfo.
   • Adds findmodule BOF module to find processes with a given module (DLL) loaded.
   • Adds findprochandle BOF module to find processes holding a handle to a named object.
   • Adds startwebclient BOF module to start the WebClient service via ETW trigger registration.
   • Adds lapsdump BOF module to dump LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. passwords (ms-Mcs-AdmPwd) from AD via LDAP.
   • Adds ./ps-empire update subcommand that moves the checkout to the latest release tag, refreshes config.yaml, fast-forwards Starkiller, the plugin registry, and the Empire Compiler binary, and applies pending Alembic migrations; use -y to auto-confirm the backup prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds starkiller.directory config option to serve an already-built Starkiller instead of cloning from GitHub, enabling air-gapped and distro-packaged installs.
   • Adds POST /api/v2/agents/{id}/tasks/chdir endpoint and TASK_CHDIR (opcode 44) for persistently changing an agent's working directory across PowerShell, Python, and IronPython agents.
   • Adds AES-256-GCM across the stack: an AES256GCM AEAD class in encryption.py (server), agent/stagers/common/aesgcm.py for Python/IronPython stagers, and a .NET 4.x AesGcmHelper for PowerShell stagers.
   • Adds MergeReferences option to the C# module YAML schema, enabling ILRepack dependency merging via the Empire Compiler --merge-references flag.

   +43 more show less

   • Adds SafeChecksPS / SafeChecksPython bypass YAMLs consolidating bypass snippets; opt in via a stager's Bypasses parameter.
   • Adds parser support for the Cobalt Strike http-config block in malleable HTTP listeners, wiring trust_x_forwarded_for (default false) and block_useragents (fnmatch globs).
   • Adds a krb_session_key credential type storing Rubeus session keys as <keytype>:<base64key>, captured from both dump and asktgt/asktgs output.
   • Adds a per-option format_string override and {{ VALUE_ARRAY }} token for rendering PowerShell [Array] parameters as double-quoted, comma-joined elements.
   • Adds AFTER_CHAT_MESSAGE_HOOK core hook fired with (db, message: ChatMessage) after a chat message is persisted, enabling plugins to observe chat traffic.
   • Adds a downloadable chatlog report via report=chat (included in report=all), exporting chatlog.csv; chat is now persisted to a new chat_messages table (Alembic migration 0003) and chat/history returns the most recent 20 messages.
   • Adds an Inveigh credential parser (situational_awareness/host/inveigh) that ingests NetNTLMv1/v2 hashes from task output, tagging machine accounts as inveigh machine_account.
   • Adds SharpHound C# module for BloodHound Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enumeration with ILRepack assembly merging.
   • Adds situational-awareness modules powershell/situational_awareness/host/{processes,ipconfig,route,dir_list} and python/situational_awareness/host/processes, emitting JSON for server-side filters.
   • Adds wdtoggle BOF module to patch WDigest/Credential Guard in LSASS to re-enable plaintext credential caching.
   • Adds psx BOF module for a process list annotated with detected security products (AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./logging tools).
   • Adds psm BOF module for detailed single-process info by PID — loaded modules, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections, and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sessions.
   • Adds psk BOF module to enumerate loaded kernel modules/drivers annotated with security-product driver detection.
   • Adds psw BOF module to enumerate window titles across running processes.
   • Adds psc BOF module for a process list with active TCP connections and RDP session details.
   • Adds winver BOF module to retrieve Windows version, build number, and patch revision of the target host.
   • Adds netuse_add, netuse_list, and netuse_delete BOF modules for mapping shares, enumerating connections, and disconnecting mapped drives.
   • Adds sc_enum BOF module to bulk-enumerate all services on a local or remote host via SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. (config, query, failure, and trigger data).
   • Adds sc_qc BOF module to query a Windows service's configuration (binary path, start type, account, dependencies) via SCM.
   • Adds sc_qdescription BOF module to query a Windows service's description via SCM.
   • Adds sc_qfailure BOF module to query a Windows service's failure actions (restart, run command, reboot) via SCM.
   • Adds sc_qtriggerinfo BOF module to query the trigger events that start or stop a Windows service.
   • Adds netuserenum BOF module to enumerate local or domain user accounts via NetUserEnum with a configurable filter.
   • Adds nslookup BOF module for DNS lookups via the Windows DNS client API, with optional custom server and record type.
   • Adds notepad BOF module to enumerate open Notepad/Notepad++ windows and extract the displayed file path or in-memory text.
   • Adds findLoadedModule BOF module to enumerate processes that have a given module (DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. substring) loaded — useful for locating injection targets and fingerprinting EDR.
   • Adds vssenum BOF module to enumerate Volume Shadow Copies exposed on a host's SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. share, useful for locating offline SAM/SYSTEM/NTDS hives.
   • Adds addmachineaccount BOF module for adding machine accounts (lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.).
   • Adds nonpaged_ldapsearch BOF module for synchronous non-paged LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. queries against a domain controller, useful when paged queries are throttled.
   • Adds ldapsearch BOF module for LDAP/LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. queries against a domain controller with configurable scope.
   • Adds reg_query BOF module for in-agent Windows registry queries — key enumeration, value lookup, and recursive traversal — on local or remote systems.
   • Adds etw_patching BOF module to patch or revert EtwEventWrite in ntdll to degrade ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. logging in-process.
   • Adds static_syscalls_dump BOF module to dump a target process's memory via static syscall numbers, bypassing ntdll hooks.
   • Adds static_syscalls_inject BOF module to inject shellcode into a remote process via static syscalls.
   • Adds static_syscalls_apc_spawn BOF module to spawn a temporary process and inject shellcode via APC queue using static syscalls.
   • Adds syscalls_shellcode_injection BOF module to inject shellcode into a remote process via direct syscalls.
   • Adds reconad BOF module for ADSI-based Active Directory reconnaissance.
   • Adds domaininfo BOF module to report AD domain membership and Azure AD join status of the host.
   • Adds smbinfo BOF module to retrieve SMB server info via NetServerGetInfo.
   • Adds findmodule BOF module to find processes with a given module (DLL) loaded.
   • Adds findprochandle BOF module to find processes holding a handle to a named object.
   • Adds startwebclient BOF module to start the WebClient service via ETW trigger registration.
   • Adds lapsdump BOF module to dump LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. passwords (ms-Mcs-AdmPwd) from AD via LDAP.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Password hashing switched from bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. to PBKDF2-HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. (600K iterations); existing bcrypt hashes are incompatible — reset passwords or recreate the database. Non-default bcrypt users must be manually reset via PUT /api/v2/users/{id}/password.
   • !Staging key normalization replaced MD5 with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.; agents staged under the old algorithm must be re-staged.
   • !CSPRNGCSPRNGA cryptographically secure pseudorandom number generator — an algorithm that produces unpredictable output suitable for secrets like keys and tokens, where a standard PRNG's statistical randomness alone would be exploitable. generation replaced random with secrets (server) and random.SystemRandom() (agent) across listeners, stagers, agents, and utilities; all deployed agents must be re-staged.
   • !./ps-empire update overwrites the base config.yaml on every run — move local customizations to config.user.yaml before upgrading.
   • !Debian 11 (bullseye) is no longer a supported install platform; it has been removed from the install script, CI matrix, and docs.
3. v7.0.2 Sep 8, 2026 · issue 011

   Empire v7 adds 30+ BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. modules, AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption., chunked uploads, persistent chdir, and a new ps-empire update subcommand⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v7.0.2 https://github.com/BC-SECURITY/Empire.git
   # already have the repo? check out this version:
   $ git checkout v7.0.2

   └──▷ TRY IT
   Upgrade an Empire server to the latest release, automatically confirming the database backup prompt and applying any pending schema migrations.
   copy

   $ ./ps-empire update -y

   Serve an already-built Starkiller from a local directory for an air-gapped install, bypassing the GitHub clone step at startup.
   config.user.yaml copy

   starkiller:
     directory: /opt/starkiller/dist

   • Adds ./ps-empire update subcommand that moves the checkout to the latest release tag, refreshes config.yaml, fast-forwards Starkiller, the plugin registry, and the Empire Compiler binary, and applies pending Alembic migrations; use -y to auto-confirm the backup prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds starkiller.directory config option to serve an already-built Starkiller instead of cloning from GitHub, enabling air-gapped and distro-packaged installs.
   • Adds POST /api/v2/agents/{id}/tasks/chdir endpoint and TASK_CHDIR (opcode 44) for persistently changing an agent's working directory across PowerShell, Python, and IronPython agents.
   • Adds chunked file uploads to agents — files split into 512KB chunks drip-fed across checkins — removing the previous 1MB upload limit with backward-compatible protocol detection.
   • Adds AES-256-GCM across the stack: an AES256GCM AEAD class in encryption.py (server), agent/stagers/common/aesgcm.py for Python/IronPython stagers, and a .NET 4.x AesGcmHelper for PowerShell stagers.

   +45 more show less

   • Adds MergeReferences option to the C# module YAML schema, enabling ILRepack dependency merging via the Empire Compiler --merge-references flag.
   • Adds InjectSelf option (default true) to inject_amsi_bypass and inject_etw_bypass — set false to target a remote PID instead of the agent's own process.
   • Adds SafeChecksPS / SafeChecksPython bypass YAMLs consolidating bypass snippets; opt in via a stager's Bypasses parameter.
   • Adds parser support for the Cobalt Strike http-config block in malleable HTTP listeners, wiring trust_x_forwarded_for (default false) and block_useragents (fnmatch globs).
   • Adds a krb_session_key credential type storing Rubeus session keys as <keytype>:<base64key>, captured from both dump and asktgt/asktgs output.
   • Adds a per-option format_string override and {{ VALUE_ARRAY }} token for rendering PowerShell [Array] parameters as double-quoted, comma-joined elements.
   • Adds AFTER_CHAT_MESSAGE_HOOK core hook fired with (db, message: ChatMessage) after a chat message is persisted, enabling plugins to observe chat traffic.
   • Adds a downloadable chatlog report via report=chat (included in report=all), exporting chatlog.csv; chat is now persisted to a new chat_messages table (Alembic migration 0003) and chat/history returns the most recent 20 messages.
   • Adds an Inveigh credential parser (situational_awareness/host/inveigh) that ingests NetNTLMv1/v2 hashes from task output, tagging machine accounts as inveigh machine_account.
   • Adds SharpHound C# module for BloodHound Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enumeration with ILRepack assembly merging.
   • Adds situational-awareness modules powershell/situational_awareness/host/{processes,ipconfig,route,dir_list} and python/situational_awareness/host/processes, emitting JSON for server-side filters.
   • Adds wdtoggle BOF module to patch WDigest/Credential Guard in LSASS to re-enable plaintext credential caching.
   • Adds psx BOF module for a process list annotated with detected security products (AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./logging tools).
   • Adds psm BOF module for detailed single-process info by PID — loaded modules, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections, and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sessions.
   • Adds psk BOF module to enumerate loaded kernel modules/drivers annotated with security-product driver detection.
   • Adds psw BOF module to enumerate window titles across running processes.
   • Adds psc BOF module for a process list with active TCP connections and RDP session details.
   • Adds winver BOF module to retrieve Windows version, build number, and patch revision of the target host.
   • Adds netuse_add, netuse_list, and netuse_delete BOF modules for mapping shares, enumerating connections, and disconnecting mapped drives.
   • Adds sc_enum BOF module to bulk-enumerate all services on a local or remote host via SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. (config, query, failure, and trigger data).
   • Adds sc_qc BOF module to query a Windows service's configuration (binary path, start type, account, dependencies) via SCM.
   • Adds sc_qdescription BOF module to query a Windows service's description via SCM.
   • Adds sc_qfailure BOF module to query a Windows service's failure actions (restart, run command, reboot) via SCM.
   • Adds sc_qtriggerinfo BOF module to query the trigger events that start or stop a Windows service.
   • Adds netuserenum BOF module to enumerate local or domain user accounts via NetUserEnum with a configurable filter.
   • Adds nslookup BOF module for DNS lookups via the Windows DNS client API, with optional custom server and record type.
   • Adds notepad BOF module to enumerate open Notepad/Notepad++ windows and extract the displayed file path or in-memory text.
   • Adds findLoadedModule BOF module to enumerate processes that have a given module (DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. substring) loaded — useful for locating injection targets and fingerprinting EDR.
   • Adds vssenum BOF module to enumerate Volume Shadow Copies exposed on a host's SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. share, useful for locating offline SAM/SYSTEM/NTDS hives.
   • Adds addmachineaccount BOF module for adding machine accounts (lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.).
   • Adds nonpaged_ldapsearch BOF module for synchronous non-paged LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. queries against a domain controller, useful when paged queries are throttled.
   • Adds ldapsearch BOF module for LDAP/LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. queries against a domain controller with configurable scope.
   • Adds reg_query BOF module for in-agent Windows registry queries — key enumeration, value lookup, and recursive traversal — on local or remote systems.
   • Adds etw_patching BOF module to patch or revert EtwEventWrite in ntdll to degrade ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. logging in-process.
   • Adds static_syscalls_dump BOF module to dump a target process's memory via static syscall numbers, bypassing ntdll hooks.
   • Adds static_syscalls_inject BOF module to inject shellcode into a remote process via static syscalls.
   • Adds static_syscalls_apc_spawn BOF module to spawn a temporary process and inject shellcode via APC queue using static syscalls.
   • Adds syscalls_shellcode_injection BOF module to inject shellcode into a remote process via direct syscalls.
   • Adds reconad BOF module for ADSI-based Active Directory reconnaissance.
   • Adds domaininfo BOF module to report AD domain membership and Azure AD join status of the host.
   • Adds smbinfo BOF module to retrieve SMB server info via NetServerGetInfo.
   • Adds findmodule BOF module to find processes with a given module (DLL) loaded.
   • Adds findprochandle BOF module to find processes holding a handle to a named object.
   • Adds startwebclient BOF module to start the WebClient service via ETW trigger registration.
   • Adds lapsdump BOF module to dump LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. passwords (ms-Mcs-AdmPwd) from AD via LDAP.
   • Adds ./ps-empire update subcommand that moves the checkout to the latest release tag, refreshes config.yaml, fast-forwards Starkiller, the plugin registry, and the Empire Compiler binary, and applies pending Alembic migrations; use -y to auto-confirm the backup prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds starkiller.directory config option to serve an already-built Starkiller instead of cloning from GitHub, enabling air-gapped and distro-packaged installs.
   • Adds POST /api/v2/agents/{id}/tasks/chdir endpoint and TASK_CHDIR (opcode 44) for persistently changing an agent's working directory across PowerShell, Python, and IronPython agents.
   • Adds AES-256-GCM across the stack: an AES256GCM AEAD class in encryption.py (server), agent/stagers/common/aesgcm.py for Python/IronPython stagers, and a .NET 4.x AesGcmHelper for PowerShell stagers.
   • Adds MergeReferences option to the C# module YAML schema, enabling ILRepack dependency merging via the Empire Compiler --merge-references flag.

   +43 more show less

   • Adds SafeChecksPS / SafeChecksPython bypass YAMLs consolidating bypass snippets; opt in via a stager's Bypasses parameter.
   • Adds parser support for the Cobalt Strike http-config block in malleable HTTP listeners, wiring trust_x_forwarded_for (default false) and block_useragents (fnmatch globs).
   • Adds a krb_session_key credential type storing Rubeus session keys as <keytype>:<base64key>, captured from both dump and asktgt/asktgs output.
   • Adds a per-option format_string override and {{ VALUE_ARRAY }} token for rendering PowerShell [Array] parameters as double-quoted, comma-joined elements.
   • Adds AFTER_CHAT_MESSAGE_HOOK core hook fired with (db, message: ChatMessage) after a chat message is persisted, enabling plugins to observe chat traffic.
   • Adds a downloadable chatlog report via report=chat (included in report=all), exporting chatlog.csv; chat is now persisted to a new chat_messages table (Alembic migration 0003) and chat/history returns the most recent 20 messages.
   • Adds an Inveigh credential parser (situational_awareness/host/inveigh) that ingests NetNTLMv1/v2 hashes from task output, tagging machine accounts as inveigh machine_account.
   • Adds SharpHound C# module for BloodHound Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enumeration with ILRepack assembly merging.
   • Adds situational-awareness modules powershell/situational_awareness/host/{processes,ipconfig,route,dir_list} and python/situational_awareness/host/processes, emitting JSON for server-side filters.
   • Adds wdtoggle BOF module to patch WDigest/Credential Guard in LSASS to re-enable plaintext credential caching.
   • Adds psx BOF module for a process list annotated with detected security products (AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./logging tools).
   • Adds psm BOF module for detailed single-process info by PID — loaded modules, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections, and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sessions.
   • Adds psk BOF module to enumerate loaded kernel modules/drivers annotated with security-product driver detection.
   • Adds psw BOF module to enumerate window titles across running processes.
   • Adds psc BOF module for a process list with active TCP connections and RDP session details.
   • Adds winver BOF module to retrieve Windows version, build number, and patch revision of the target host.
   • Adds netuse_add, netuse_list, and netuse_delete BOF modules for mapping shares, enumerating connections, and disconnecting mapped drives.
   • Adds sc_enum BOF module to bulk-enumerate all services on a local or remote host via SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. (config, query, failure, and trigger data).
   • Adds sc_qc BOF module to query a Windows service's configuration (binary path, start type, account, dependencies) via SCM.
   • Adds sc_qdescription BOF module to query a Windows service's description via SCM.
   • Adds sc_qfailure BOF module to query a Windows service's failure actions (restart, run command, reboot) via SCM.
   • Adds sc_qtriggerinfo BOF module to query the trigger events that start or stop a Windows service.
   • Adds netuserenum BOF module to enumerate local or domain user accounts via NetUserEnum with a configurable filter.
   • Adds nslookup BOF module for DNS lookups via the Windows DNS client API, with optional custom server and record type.
   • Adds notepad BOF module to enumerate open Notepad/Notepad++ windows and extract the displayed file path or in-memory text.
   • Adds findLoadedModule BOF module to enumerate processes that have a given module (DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. substring) loaded — useful for locating injection targets and fingerprinting EDR.
   • Adds vssenum BOF module to enumerate Volume Shadow Copies exposed on a host's SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. share, useful for locating offline SAM/SYSTEM/NTDS hives.
   • Adds addmachineaccount BOF module for adding machine accounts (lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.).
   • Adds nonpaged_ldapsearch BOF module for synchronous non-paged LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. queries against a domain controller, useful when paged queries are throttled.
   • Adds ldapsearch BOF module for LDAP/LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. queries against a domain controller with configurable scope.
   • Adds reg_query BOF module for in-agent Windows registry queries — key enumeration, value lookup, and recursive traversal — on local or remote systems.
   • Adds etw_patching BOF module to patch or revert EtwEventWrite in ntdll to degrade ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. logging in-process.
   • Adds static_syscalls_dump BOF module to dump a target process's memory via static syscall numbers, bypassing ntdll hooks.
   • Adds static_syscalls_inject BOF module to inject shellcode into a remote process via static syscalls.
   • Adds static_syscalls_apc_spawn BOF module to spawn a temporary process and inject shellcode via APC queue using static syscalls.
   • Adds syscalls_shellcode_injection BOF module to inject shellcode into a remote process via direct syscalls.
   • Adds reconad BOF module for ADSI-based Active Directory reconnaissance.
   • Adds domaininfo BOF module to report AD domain membership and Azure AD join status of the host.
   • Adds smbinfo BOF module to retrieve SMB server info via NetServerGetInfo.
   • Adds findmodule BOF module to find processes with a given module (DLL) loaded.
   • Adds findprochandle BOF module to find processes holding a handle to a named object.
   • Adds startwebclient BOF module to start the WebClient service via ETW trigger registration.
   • Adds lapsdump BOF module to dump LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. passwords (ms-Mcs-AdmPwd) from AD via LDAP.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Password hashing switched from bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. to PBKDF2-HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. (600K iterations); existing bcrypt hashes are incompatible — reset passwords or recreate the database. Non-default bcrypt users must be manually reset via PUT /api/v2/users/{id}/password.
   • !Staging key normalization replaced MD5 with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.; agents staged under the old algorithm must be re-staged.
   • !CSPRNGCSPRNGA cryptographically secure pseudorandom number generator — an algorithm that produces unpredictable output suitable for secrets like keys and tokens, where a standard PRNG's statistical randomness alone would be exploitable. generation replaced random with secrets (server) and random.SystemRandom() (agent) across listeners, stagers, agents, and utilities; all deployed agents must be re-staged.
   • !./ps-empire update overwrites the base config.yaml on every run — move local customizations to config.user.yaml before upgrading.
   • !Debian 11 (bullseye) is no longer a supported install platform; it has been removed from the install script, CI matrix, and docs.
4. 7.0.1 Aug 25, 2026 · release notes

   Empire 7.0.1 adds Inveigh NetNTLM hash parsing, Rubeus session key support, and format_string overrides

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 7.0.1 https://github.com/BC-SECURITY/Empire.git
   # already have the repo? check out this version:
   $ git checkout 7.0.1

   • Added situational_awareness/host/inveigh credential parser to ingest NetNTLMv1/v2 hashes from task output.
   • Added per-option format_string override and {{ VALUE_ARRAY }} token for rendering PowerShell [Array] parameters as comma-joined elements.
   • Added krb_session_key credential type for Rubeus session keys stored as <keytype>:<base64key>.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. agent-certificate verification is now mandatory in the PowerShell and C# staging branches, previously skipped for an all-zero certificate.
5. 7.0.0 Aug 12, 2026 · release notes

   v7.0.0 adds PS-Empire update command, chat hooks, BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. modules, and chunked uploads.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 7.0.0 https://github.com/BC-SECURITY/Empire.git
   # already have the repo? check out this version:
   $ git checkout 7.0.0

   └──▷ USE IT
   Upgrade ps-empire and apply database migrations automatically in CI/CD.
   shell copy

   ./ps-empire update -y

   Persistently change the working directory of a specific agent via API.
   api copy

   curl -X POST http://<server>:1337/api/v2/agents/<id>/tasks/chdir -H 'Authorization: Bearer <token>' -d '{"arguments": "C:\\Temp"}'

   • ./ps-empire update subcommand now handles Alembic migrations automatically with -y flag for upgrades, refreshing config.yaml and Starkiller
   • Added AFTER_CHAT_MESSAGE_HOOK core hook allowing plugins to observe chat traffic via (db, message: ChatMessage) parameters
   • New starkiller.directory config option serves a pre-built Starkiler frontend instead of cloning from GitHub at startup
   • BOF modules added including wdtoggle, psx, psm, psk, psw, psc, winver, netuse_add/list/delete, sc_enum/qc/qdescription/qfailure/qtriggerinfo, netuserenum, nslookup, notepad, sprayad, findLoadedModule, vssenum, addmachineaccount, nonpaged_ldapsearch, ldapsearch, and 12 additional modules for injection, evasion, and AD recon
   • inject_amsi_bypass and inject_etw_bypass gain InjectSelf option (default true) to target remote PIDs when set to false

   +1 more show less

   • New TASK_CHDIR opcode 44 and POST /api/v2/agents/{id}/tasks/chdir endpoint allow persistently changing the agent's working directory

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Replaced bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. password hashing with PBKDF2-HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it., requiring password reset or database recreation for existing hashes.
   • !Replaced MD5 with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. for staging key normalization; agents staged under the old algorithm must be re-staged.
   • !Replaced random with secrets (server) and random.SystemRandom() (agent) for CSPRNGCSPRNGA cryptographically secure pseudorandom number generator — an algorithm that produces unpredictable output suitable for secrets like keys and tokens, where a standard PRNG's statistical randomness alone would be exploitable. generation, requiring deployed agents to be re-staged.
   • !./ps-empire update overwrites the base config.yaml; local customizations must be moved to config.user.yaml.
6. v6.6.0 May 28, 2026 · release notes

   Empire v6.6.0 adds 49 ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior.-mapped modules, 8 new BOFs (including nanodump & bofroast), a pre-obfuscation API endpoint, and Alembic DB migrations.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v6.6.0 https://github.com/BC-SECURITY/Empire.git
   # already have the repo? check out this version:
   $ git checkout v6.6.0

   └──▷ TRY IT
   Run the full Empire test suite, or pass pytest arguments to target a specific test file or marker.
   copy

   $ ./ps-empire test -k mysql -v

   Tune MySQL connection pool size and enable pre-ping health checks to prevent pool exhaustion under high agent concurrency.
   yaml copy

   mysql:
     pool_size: 20
     max_overflow: 10
     pool_pre_ping: true
     pool_recycle: 3600

   • Adds nanodump BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. module for LSASS minidump creation using multiple evasion techniques (handle duplication, process forking, snapshot, seclogon handle leaking).
   • Adds 7 new BOF modules from Sliver Armory: unhook (EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./AV API hook removal), patchit (AMSI+ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. all-in-one), inject_amsi_bypass, inject_etw_bypass, credman (Credential Manager dump), handlekatz (LSASS via handle duplication), and bofroast (CLR-free KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access.).
   • Adds multi-language stager support (powershell, csharp, ironpython, go) to UAC bypass modules: bypassuac, bypassuac_env, bypassuac_eventvwr, bypassuac_sdctlbypass, bypassuac_wscript.
   • Adds POST /api/v2/obfuscation/modules/preobfuscate endpoint to trigger background pre-obfuscation of specific modules by ID (returns HTTP 202).
   • Adds Alembic database migration framework for versioned schema management, including migrate_db() and backup_db() helper functions.

   +6 more show less

   • Adds configurable MySQL connection pool settings (pool_size, max_overflow, pool_pre_ping, pool_recycle) via server config YAML, with pool health monitoring that warns at 80% capacity.
   • Adds configurable obfuscation.timeout setting (default 300s, disable with 0) for the PowerShell obfuscation subprocess, configurable via config.yaml or EMPIRE_OBFUSCATION__TIMEOUT env var.
   • Adds ./ps-empire test command as a convenience wrapper for pytest with passthrough arguments.
   • Adds strict and suggested_values fields to boolean switch options in modules for improved validation and UI hints.
   • Adds dynamic depends_on support to stagers so dependent fields (Bypasses, Obfuscate, ObfuscateCommand) show or hide based on the selected listener type.
   • Updates Starkiller to v3.5.0.

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The legacy archive field is removed from empire_compiler config; replace it with repo and ref.
   • !High-frequency hooks (AFTER_AGENT_CALLBACK_HOOK, AFTER_TASKING_RESULT_HOOK, AFTER_AGENT_CHECKIN_HOOK, AFTER_TASKING_HOOK) now receive None as the session argument instead of an active session — any hook code that uses the passed session directly will break.
7. v6.5.0 Apr 5, 2026 · release notes

   Empire v6.5.0 adds C stagers with shellcode compilation, six new offensive modules, and a runtime Background option for C# tasks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v6.5.0 https://github.com/BC-SECURITY/Empire.git
   # already have the repo? check out this version:
   $ git checkout v6.5.0

   └──▷ TRY IT
   Run the new AWS IMDS module against a compromised EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. agent to steal IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role credentials without touching disk.
   copy

   $ (Empire: agents) > interact <agent_name>
   (Empire: <agent_name>) > usemodule python/collection/aws_imds
   (Empire: python/collection/aws_imds) > execute

   • Adds a C stager for lightweight stage0 shellcode injection via Fibers
   • Adds shellcode_compiler utility to compile position-independent C stagers into raw x64 shellcode for BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. process injection
   • Adds clipboard_window_inject_list BOF module for enumerating processes with clipboard window class
   • Adds a runtime Background option to C# modules, letting operators override background/foreground execution at task time
   • Adds C# PatchETW module for in-process ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. patching via ntdll!EtwEventWrite

   +10 more show less

   • Adds C# PatchlessAMSI module for patchless AMSI bypass using hardware breakpoints and vectored exception handling
   • Adds PowerShell Invoke-VSSExtract module for NTDS.dit and SYSTEM hive extraction via Volume Shadow Copy
   • Adds PowerShell Invoke-RDPHijack module for RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. session hijacking via tscon.exe
   • Adds Python linux_keyring module for credential extraction from the Linux kernel keyring subsystem
   • Adds Python aws_imds module for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. role credential theft via EC2 Instance Metadata Service
   • Adds BOF spawn module for EarlyBird process hollowing with suspended process creation, shellcode injection, and APC thread hijacking
   • Logs Empire version and git commit SHA at startup for easier production diagnostics; SHA is baked into Docker images via --build-arg
   • Adds Python 3.14 support (3.13 and 3.14); Dockerfile now uses python:3.14.3-trixie
   • Refactors bof_packer into a Packer class with granular packing methods (addbytes, addstr, addWstr, addbool, adduint32, addint, addshort)
   • Adds format_bof_output() to ModuleService to centralize BOF output formatting for Go and .NET agents

   15 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The secinject BOF module and its pre-compiled binary have been removed; any playbooks or profiles referencing it will break.
   • !stager_generation_service now uses install_path (Path) instead of the deprecated installPath (str); any code or plugins referencing installPath on this service will break.
   • !All remaining core usages of installPath have been migrated to install_path (Path); external plugins or integrations that reference installPath on core services will break.
   • !The terminaltables dependency has been replaced with prettytable; code or plugins that import terminaltables directly will break.
   • !bof_packer standalone functions have been replaced by a Packer class API; any code calling the old standalone functions will break.
8. v6.4.1 Feb 16, 2026 · release notes

   Empire v6.4.1 adds config layering, auto-install plugins, Socket.IO toggle, and a new C# spawn module.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v6.4.1 https://github.com/BC-SECURITY/Empire.git
   # already have the repo? check out this version:
   $ git checkout v6.4.1

   └──▷ USE IT
   Override individual server settings per-environment without editing the shared base config — useful in team or containerised deployments.
   yaml copy

   # config.user.yaml (placed alongside config.yaml)
   server:
     socketio: false

   Enable automatic marketplace plugin installation so a fresh Empire server is fully tooled up on first run.
   yaml copy

   # config.yaml
   plugin_marketplace:
     auto_install: true

   • Adds config.user.yaml layering: drop a file next to config.yaml to override specific settings without touching the base config.
   • Adds auto_install option to plugin_marketplace config for automatic plugin installation at setup time.
   • Adds server.socketio config option to disable Socket.IO (enabled by default).
   • Adds C# spawn module supporting both PowerShell and C# executables.

   4 details in Everything

9. 6.4.0 Jan 18, 2026 · release notes

   Empire 6.4.0 adds clipboard enumeration via WinRT, background task tracking, and new API/CLI surfaces

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 6.4.0 https://github.com/BC-SECURITY/Empire.git
   # already have the repo? check out this version:
   $ git checkout 6.4.0

   └──▷ TRY IT
   Build and override Empire configuration during setup.
   copy

   $ ps-empire -c -o /custom/path/config.yml

   • Adds Get-ClipboardHistory PowerShell module to enumerate Windows clipboard history on Windows 10/11 via WinRT APIs
   • Adds -c (compile from source) and -o (override) options to the ps-empire CLI

   2 details in Everything

10. v6.3.0 Dec 12, 2025 · release notes

    Empire v6.3.0 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. agent support, ChaCha20-Poly1305 routing encryption, multi-language PSexec payloads, and customizable C# obfuscation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.3.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v6.3.0

    └──▷ HOW TO FIND IT
    Select a Go agent payload instead of PowerShell when laterally moving with PSexec, useful for evading PowerShell-focused defenses.
    📍In the Empire client, when configuring the PSexec module, set the Language option to go to generate a Go-based Empire payload instead of the default PowerShell one.
    • Adds mTLS support to agents and listeners for mutual certificate-based authentication.
    • Upgrades routing packet encryption from RC4 to ChaCha20-Poly1305 for authenticated encryption.
    • Exposes all agent language options (C#, IronPython, Go, PowerShell) in PSexec payload selection.
    • Adds customizable C# obfuscation via ConfuserEx XML config through EmpireCompiler v0.4.1.
    • Supports overriding all Empire config values with environment variables.

    +3 more show less

    • Changes PowerShell agent key exchange from RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. to Diffie-Hellman.
    • Moves default bypasses from individual stagers/modules into centralized config.
    • Allows the HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. host value to be used on HTTP and malleable listeners without requiring a cert path.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !RC4 is no longer used to deliver routing packets to agents — agents and listeners must both be on v6.3.0 for the ChaCha20-Poly1305 encrypted routing to be compatible.
11. v6.2.0 Sep 2, 2025 · release notes

    Empire v6.2.0 adds server clean/reset options, Go agent support for spawn/spawnas, multi-language fodhelper, and alternative auth header.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.2.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v6.2.0

    • Adds clean and reset options to the Empire server for easier environment management.
    • Adds Go agent support to the spawn and spawnas modules.
    • Extends fodhelper UAC bypass to support additional agent languages beyond the previous default.
    • Supports X-Empire-Token as an alternative authentication header to Authorization for Empire API requests.
    • Updates Starkiller to v3.1.0.

    5 details in Everything

12. v6.1.2 May 21, 2025 · release notes

    Empire v6.1.2 adds Ubuntu 24.04 support to the install script.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.1.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v6.1.2

13. v6.0.3 Apr 24, 2025 · release notes

    PowerShell Empire 6.0.3 adds literal interpretation for shell commands in the IronPython agent.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v6.0.3

    └──▷ BREAKING ON UPGRADE

    • !Linux is removed as a Go agent target option.
14. v6.0.0 Mar 25, 2025 · release notes

    Empire v6.0.0 adds Go agents, a Plugin Marketplace, a new Empire Compiler for C#, and expanded IP allow/deny list support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v6.0.0

    └──▷ TRY IT
    Run a remote PowerShell script on an agent using the new invoke-script module.
    copy

    $ usemodule code_execution/invoke-script
    set Agent <agent_name>
    set ScriptPath <path_to_ps1>
    execute

    Run a remote Python script on a Python agent using the new python invoke-script module.
    copy

    $ usemodule python/code_execution/invoke-script
    set Agent <agent_name>
    set ScriptPath <path_to_py>
    execute

    • Adds Go agents with a new multi_go_exe stager type and Go as an option for multi_launcher.
    • Introduces a Plugin Marketplace via Starkiller 3.0 with support for plugin registries and installing plugins via the API.
    • Replaces the old C# compilation approach with a new Empire-Compiler that auto-downloads pre-compiled binaries, eliminating dotnet as an OS dependency.
    • Adds new allow/deny list implementation with proper support for IPv4, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., ranges, and CIDRs.
    • Adds API endpoints for managing autorun commands on agent check-in.

    +10 more show less

    • Adds api.ip and api.secure as server config options.
    • Adds dynamic options to modules.
    • Adds module code_execution/invoke-script for remote PowerShell script execution.
    • Adds module python/code_execution/invoke-script for remote Python script execution.
    • Adds SharpHound ingestor for Community Edition and tags legacy BloodHound.
    • Adds language compatibility check so modules only run on agents that support the required language.
    • Adds -f flag to the install script to force installation as root.
    • Swaps C# module RunOF for COFFLoader.
    • Updates BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. parsing to use bof_pack formatting.
    • Updates Starkiller to v3.0.0, now served at {api_url}/.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The command line client has been removed; use Starkiller instead.
    • !--restip and --restport command-line options are removed; use the config file instead.
    • !socketport config option on the client is removed.
    • !All config properties in client and server configs are renamed to snake_case.
    • !ip_whitelist and ip_blacklist are renamed to ip_allow_list and ip_deny_list and are now lists instead of comma-separated strings.
    • !Starkiller is now accessed at {api_url}/ instead of {api_url}/index.html.
    • !The Agents class is moved to AgentCommunicationService with refactored function and parameter names.
    • !The Stagers class is moved to StagerGenerationService with refactored function and parameter names.
    • !Plugin Task handling is moved from PluginService to PluginTaskService.
    • !Socks management is moved to AgentSocksService with socks properties renamed to use plural naming.
    • !The update_lastseen parameter is removed from handle_agent_request.
    • !module_service.execute_module now returns a pydantic model.
    • !agent_task_service functions now take a user model instead of a user ID.
    • !All writable data is moved out of the install path into ~/.local/share/empire.
    • !The Listeners class is removed.
    • !The Credentials class is removed.
    • !Functions from the Agents class deprecated in 5.x are removed.
    • !Script and module upload to memory is removed in favor of modules with the same functionality.
    • !The reverseshellserver plugin is removed.
    • !empire_config.directories.module_source and empire_config.directories.obfuscated_module_source config keys are removed.
    • !The csharpserver plugin is replaced by the DotnetCompiler class in empire.server.common.
    • !The nim stager is removed from Empire and the install script.
    • !Minimum Python version raised to 3.13.
    • !Removed listeners: HTTP COM, OneDrive, and Dropbox.
    • !Removed stagers: osx/pkg, windows/backdoorlnkmacro, windows/launcher_lnk, windows/launcher_sct, windows/ms16-051, windows/reverseshell.
    • !All C# module code has been moved as submodules of Empire-Compiler.
    • !Debian 10 is no longer supported by the install script.
15. v5.12.0 Dec 14, 2024 · release notes

    Empire v5.12.0 adds Python 3.13 support and system-wide deployment capability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.12.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.12.0

    • Supports Python 3.13 as a valid runtime.
    • Enables system-wide deployment of Empire for multi-user environments.
    • Automatically falls back to ~/.empire directory when config.yaml paths lack write permission, and updates config.yaml accordingly.

    3 details in Everything

16. v5.11.4 Sep 4, 2024 · release notes

    Empire v5.11.4 adds nameserver enumeration check for Linux hosts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.11.4 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.11.4

17. v5.11.2 Aug 8, 2024 · release notes

    Empire v5.11.2 adds ThreadlessInject, Invoke-BSOD modules and ticketdumper; this minor release is a bug-fix only patch.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.11.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.11.2

    • Adds ThreadlessInject module for in-memory process injection without allocating executable memory pages.
    • Adds Invoke-BSOD module to trigger a Blue Screen of Death on compromised hosts.
    • Adds ticketdumper IronPython module for extracting KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. tickets from memory.

    3 details in Everything

18. 5.11.0 Jul 14, 2024 · release notes

    Empire 5.11 adds Invoke-BSOD, ticketdumper, ThreadlessInject modules and threaded powershell job execution

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.11.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.11.0

    • Adds Invoke-BSOD module to trigger blue screen of death scenarios for testing.
    • Adds ticketdumper IronPython module for credential extraction via KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. tickets.
    • Adds ThreadlessInject module for in-memory code injection without writing to disk.
    • Adds threaded job execution for PowerShell tasks using AppDomains to improve concurrency and reliability.
    • Adds detailed job tracking for all tasks within the Sharpire system instead of only tracking jobs.

    5 details in Everything

19. 5.10.3 May 23, 2024 · release notes

    Empire 5.10.3 updates default behaviors for SharpUp, Seatbelt, and SharpWMI/S sharpsc, and adds --debug to Moriarty.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.10.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.10.3

    • Updates the --action default for SharpSC modules to query service= for broader enumeration
    • Adds --debug flag support to Moriarty listeners to enable verbose logging during agent check-ins
    • Changes SharpWMI module default action from execute to query reducing execution noise

    3 details in Everything

20. v5.10.1 May 3, 2024 · release notes

    Empire v5.10 adds Moriary module, callback socket messages, and sacrificial process spawning via BoF.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.10.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.10.1

    • Moriary module added for threat hunting
    • Adds hook and socket message to receive callback messages for individual agents
    • Added sacrificial Spawn Process bof
    • ./ps-empire install option added
    • Added .NET 4.5 compile option

    5 details in Everything

21. 5.10.0 Apr 8, 2024 · release notes

    Empire 5.10 adds callback hooks, Moriary module, and non-root log permissions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.10.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.10.0

    • --auto-pull submodule option enables automatic updates on startup
    • New install subcommand in ./ps-empire bootstrap script
    • Moriary PowerShell Empire module adds new tasking capabilities
    • Non-root file permissions applied to empire and listener logs

    4 details in Everything

22. v5.9.3 Feb 9, 2024 · release notes

    v5.9.3 adds Excel/Word selection and AutoOpen/AutoClose options to windows_macro stager

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.9.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.9.3

23. v5.9.1 Jan 25, 2024 · release notes

    Adds BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. modules (nanodump, secinject, etc.), YAML module format, and custom certificate path config

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.9.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.9.1

    └──▷ TRY IT
    Scan systems for credentials using the new nanodump BOF module within Empire.
    copy

    $ usemodule powershell/credentials/nanodump

    Configure Empire to use a custom TLS certificate for secure agent communications.
    yaml copy

    certfile: /path/to/custom/cert.pem
    keyfile: /path/to/custom/key.pem

    Handle validation errors in a custom module by raising the new exception type instead of returning a tuple.
    python copy

    raise ModuleValidationException('Invalid parameter provided')

    • Adds BOF modules to Empire as yaml files, including ClipBoardWindow-Inject, nanodump, secinject, tgtdelegation, and TrustedSec's SA modules
    • Adds support for returning validation/execution exceptions (ModuleValidationException, ModuleExecutionException, PluginValidationException, PluginExecutionException) from module and plugin generate/execute functions
    • Adds decorators for module generate functions to automatically get the module_source and call finalize_module
    • Adds custom certificate path configuration via server_config.yaml
    • Updates install script and Docker file to use Python 3.12.1

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Returning tuples from module generate functions is deprecated; raise ModuleValidationException for 400 errors and ModuleExecutionException for 500 errors instead of using handle_error_message
    • !Returning tuples from plugin execution functions is deprecated; raise PluginValidationException for 400 errors and PluginExecutionException for 500 errors
    • !Loading plugins from a .plugin file is deprecated; use a .py file with a plugin.yaml instead
    • !Extending the Plugin class is deprecated; use the BasePlugin class instead
    • !Plugins must now have a plugin.yaml; the Base plugin class is now BasePlugin
24. 5.9.0 Jan 20, 2024 · release notes

    Empire 5.9.0 adds YAML-based BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. modules and custom cert path to server config

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.9.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.9.0

    • Adds custom_certificate_path key to server_config.yaml to specify the TLS certificate location for the Empire server
    • Adds support for Beacon Object Files (BOFs) as YAML modules, enabling immediate use of ClipBoardWindow-Inject, nanodump, secinject, tgtdelegation, and TrustedSec's SA modules

    2 details in Everything

25. v5.8.1 Dec 4, 2023 · release notes

    v5.8.1 adds tags search to credentials API endpoints and lets users disable Starkiller.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.8.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.8.1

    • config.yaml now accepts the Starkiller.enabled key (default true) to toggle the web UI on or off
    • Credentials API endpoints (/api/credentials, /api/agents/:agent_id/creds) accept a tags query parameter to filter results

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Pydantic upgrade to v2 may require updates to custom validation logic if the tool's Python modules use Pydantic directly.
26. v5.7.3 Oct 17, 2023 · release notes

    Adds a post-staging bypass module and updates Starkiller to v2.6.1 in Empire v5.7.3

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.7.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.7.3

    • Adds a new bypass module that executes PowerShell bypasses after an agent is successfully staged.
    • Updates the Starkiller web interface to version 2.6.1.

    2 details in Everything

27. v5.6.3 Aug 27, 2023 · release notes

    Empire v5.6.3 adds Advanced Reporting Plugin; v5.6.0 introduces tagging system with REST endpoints and UI filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.6.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.6.3

    • v5.6.0 Adds tags to Listeners, Agents, Agent Tasks, Plugin Tasks, Credentials, and Downloads
    • v5.6.0 Adds API endpoints to add, edit, and delete tags for each resource type
    • v5.6.0 Adds tag list endpoint (GET /tags)
    • v5.6.0 Adds tag filters to Agent Tasks, Plugin Tasks, and Downloads queries
    • v5.6.0 Adds events for new and updated tags

    +2 more show less

    • v5.6.0 Adds Invoke-PhishingLNK Module
    • v5.6.3 Adds Advanced Reporting Plugin and dependencies

    7 details in Everything

28. 5.6.0 Jul 25, 2023 · release notes

    Empire 5.6.0 adds tagging across resources and a new Invoke-PhishingLNK module

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.6.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.6.0

    • Add tags to Listeners, Agents, Agent Tasks, Plugin Tasks, Credentials, and Downloads
    • Add endpoints to add, edit, and delete tags for each resource type
    • Add tag list endpoint
    • Add tag filters to Agent Tasks, Plugin Tasks, and Downloads
    • Add events for new and updated tags

    +1 more show less

    • Allow download_service to accept a pathlib.Path object to create a download

    6 details in Everything

29. v5.5.3 Jul 20, 2023 · release notes

    Empire v5.5.0 adds agent checkins API endpoints, Malleable Profile reloads, and multiple new Python-based modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.5.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.5.3

    • Adds checkins endpoint to retrieve agent checkin history as a list
    • Adds checkins/aggregate endpoint to get aggregated checkin data (excluded with SQLite)
    • Adds Python agent support to the hop listener for staging
    • Adds IronPython SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. Agents/Listener
    • Adds LinPEAS to Python modules

    +2 more show less

    • Adds Python obfuscation capability using python-obfuscator
    • Expands file options configuration across plugins, stagers, and listeners

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Aggregate endpoint checkins/aggregate is not supported with SQLite; using SQLite for this feature will fail.
    • !Removed .NET Core modules due to errors
    • !Removed redundant C# lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. modules
    • !Removed Covenant Mimikatz in favor of Invoke-Mimikatz
    • !Removed Invoke-Assembly in favor of Covenant's execute assembly
    • !Removed Invoke-BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. in favor of RunOF
    • !Removed Invoke-Rubeus in favor of Covenant's Rubeus
    • !Removed Invoke-Seatbelt in favor of Covenant's Seatbelt
30. 5.5.0 Jun 21, 2023 · release notes

    Empire 5.5.0 adds agent checkins endpoints, IronPython SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. agents, Python obfuscation, and reloadable profiles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.5.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.5.0

    • Adds checkins and checkins/aggregate API endpoints to expose agent checkin data as a list or aggregated view
    • Adds IronPython support for SMB Agents/Listeners
    • Adds python-obfuscator integration for Python modules
    • Adds LinPEAS to the Python modules library
    • Adds reload endpoint for Malleable Profiles, Modules, Bypasses, and Plugins

    +1 more show less

    • Adds staging capability to hop listener

    6 details in Everything

31. v5.4.2 Jun 12, 2023 · release notes

    Empire v5.4.2 includes Starkiller UI update and Python 3 support for multi_socks module

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.4.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.4.2

    • Adds python_multi_socks module compatibility with Python 3 runtime environments

    1 detail in Everything

32. v5.2.2 Apr 30, 2023 · release notes

    v5.2.2 updates Starkiller and dependencies; v5.2.0 adds plugin system with new endpoints and kwargs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.2.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.2.2

    • Update Starkiller to v2.2.0
    • Dependency upgrades (@Vinnybod)
    • Added new plugin functionality
    • Added plugin tasks
    • Added plugin task endpoints

    +1 more show less

    • Gave plugins kwargs to allow for more flexibility. Plugins are now receiving a database session and user object.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Tasks renamed to AgentTasks
33. v5.1.2 Mar 29, 2023 · release notes

    v5.1.2 ships Starkiller v2.1.1; previous versions added D/Invoke support and module script API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.1.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.1.2

    • Updated bundled Starkiller web UI to v2.1.1

    1 detail in Everything

34. 5.1.1 Mar 17, 2023 · release notes

    Empire 5.1.1 adds D/Invoke process injection, IronPython launcher support, and language options to spawn modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.1.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.1.1

    └──▷ TRY IT
    Inject process using the D/Invoke technique for stealthier execution.
    copy

    $ invoke_process_inject --technique D/Invoke

    • Adds D/Invoke option to Process Injection
    • Adds language option to spawn and spawnas modules
    • Adds IronPython and csharp to windows/launcher_bat

    3 details in Everything

35. v5.0.3 Feb 21, 2023 · release notes

    Empire v5.0.3 adds Starkiller v2.0.5, Python 3.11 support, and fixes Kerberoast; no new API endpoints or config keys introduced.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.0.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v5.0.3

    └──▷ HOW TO FIND IT
    View detailed help for a specific client command like shell.
    📍help shell
    Execute a shell command literally, bypassing any aliases that might interfere.
    copy

    $ shell --literal whoami

    • help <command> client command prints full doc string for functions like shell
    • --literal flag on shell commands to ignore built-in aliases like whoami or ps

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The old REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. has been removed; use the new v2 API instead
    • !The old WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. API has been removed; use the new v2 API instead
36. 5.0.2 Feb 14, 2023 · release notes

    Empire 5.0.2 enables task API usage with empty user identity and adds a shebang to checkout script.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.0.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.0.2

    └──▷ TRY IT
    Create a task without requiring a specific user identity.
    copy

    $ curl -X POST https://<empire-host>/api/v2/task -H 'Authorization: Bearer <token>' -d '{"module_id": "example", "user_id": ""}'

    └──▷ BREAKING ON UPGRADE

    • !The task API now uses module_id instead of module_slug for consistent naming
37. v4.10.0 Jan 31, 2023 · release notes

    Adds Debian/Ubuntu/ParrotOS support, new install flag, and Crypto Miner/PSRansom modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.10.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.10.0

    • Supports installation on Debian 11, Ubuntu 22.04, and ParrotOS
    • Adds -y option to the install script for automatic confirmation
    • Adds C# Crypto Miner module for automated cryptocurrency mining
    • Adds PSRansom module for ransomware simulation

    4 details in Everything

38. 5.0.0 Jan 15, 2023 · release notes

    Empire 5.0 adds Starkiller UI, MySQL support, v2 API, stageless agents, and --literal flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.0.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 5.0.0

    └──▷ USE IT
    Run a shell command literally, ignoring any built-in aliases like whoami or ps.
    shell copy

    shell --literal whoami

    Switch Empire to use MySQL instead of the default SQLite by setting the environment variable during startup.
    shell copy

    DATABASE_USE=mysql docker run ... empire-server

    • Adds Starkiller as an integrated web app
    • Adds full MySQL support as the new default database backend
    • Adds v2 API with autogenerated docs
    • Adds stageless options for agents
    • Adds clear window command to client

    +8 more show less

    • Adds mouse_support to client
    • Adds RunOF module to support COFF/BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. execution
    • Adds new database table for files
    • Adds server-side storage of stagers
    • Adds listener, agent, and task hooks with db session support
    • Adds global obfuscation config (removed from config table)
    • Adds authors to bypass endpoints
    • Adds help <function> command in client for full doc strings

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The old REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. is removed
    • !The old WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. API is removed
    • !The socketport config key is removed since socketio runs on the same port as the API
    • !AFTER_AGENT_STAGE2_HOOK is replaced with AFTER_AGENT_CHECKIN_HOOK
39. v4.7.1 Aug 2, 2022 · release notes

    Empire v4.7.0 adds IronPython module support, Chisel proxy submodules, and a resource file client command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.7.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.7.1

    • Add resource file command to the Empire client for loading external script files
    • New IronPython execution environment allowing PowerShell and C# scripts to run inside modules
    • Add ChiselServer plugin as a submodule for Socks proxy tunneling
    • Add SocksProxyServer plugin as a submodule for Socks proxy tunneling

    4 details in Everything

40. 4.7.0 Jun 25, 2022 · release notes

    Adds resource command, PowerShell/C# IronPython modules, ChiselServer/SocksProxyServer plugins.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.7.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 4.7.0

    • Add a resource file command to the client
    • Add ChiselServer, SocksProxyServer plugin as a submodule

    2 details in Everything

41. v4.6.1 Jun 23, 2022 · release notes

    Empire v4.6.0 adds Certify module, embedded VNC, C#/BAT obfuscation, JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. evasion, and --reset CLI flag; v4.6.1 is a bug fix.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.6.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.6.1

    └──▷ TRY IT
    Launch a .bat stager with basic parsing to ensure compatibility on older Windows systems.
    copy

    $ Empire > usestager/windows/launcher_bat
    [>] Agent: <agent_name>
    [?] Choose an Obfuscation Technique (0. None): 0
    [>] Run the following command in the target system:
    powershell.exe -nop -w hidden -c "IEX ($null..." --BasicParsing

    Reset the Empire client session state completely from the command line.
    copy

    $ empire --reset

    • Certify C# module added for active directory certificate attacks
    • Embedded VNC client and launcher for remote desktop via agent
    • New obfuscate option on C# payload creation to obfuscate generated code
    • Global obfuscation enabled for all C# modules via config/option
    • --BasicParsing flag added to .bat launcher for compatibility

    +4 more show less

    • Obfuscation support added to BAT launchers for HTTP and HTTP COM listeners
    • New option to enable or disable JA3 evasion technique
    • JA3 evasion technique now supported in Malleable HTTP profiles
    • Config option added to client UI to remove borders on tables

    9 details in Everything

42. 4.6.0 May 24, 2022 · release notes

    Empire 4.6.0 adds Certify module, embedded VNC, C# obfuscation, JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. evasion, and BAT launcher args

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.6.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 4.6.0

    └──▷ TRY IT
    Reset the Empire client configuration to defaults using the new flag
    copy

    $ empire --reset

    Launch a BAT payload with basic parsing enabled for specific CMD environments
    copy

    $ empire listeners http -o OutFile=launcher.bat -BasicParsing

    • --reset flag added to the client for resetting configuration
    • Added Certify C# module for certificate-related attacks
    • Added embedded VNC client and launcher capability
    • Added global obfuscation option to C# modules
    • Added obfuscation support to BAT launcher for HTTP and HTTP COM transports

    +4 more show less

    • Added -BasicParsing flag to the .bat launcher
    • Added option to enable/disable JA3 evasion in agent staging
    • Added JA3 evasion technique support within Malleable HTTP profiles
    • Updated client config option to remove borders on tables

    9 details in Everything

43. v4.5.3 Apr 26, 2022 · release notes

    v4.5.3 adds C# execution modules and configurable keyword obfuscation in config.yaml

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.5.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.5.3

    • script_import can now upload files from the client's machine to the agent session.
    • Adds Keyword_Obfuscations section to config.yaml to define keyword replacement lists for payload generation.
    • Adds support for C# execution modules within the Empire agent framework.

    3 details in Everything

44. 4.5.0 Mar 27, 2022 · release notes

    powershell-empire 4.5.0 introduces keyword obfuscation config, C# modules, and script_import capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.5.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 4.5.0

    • Added C# execution modules for post-exploitation
    • script_import now supports uploading a file from the client's machine

    2 details in Everything

45. v4.4.1 Mar 16, 2022 · release notes

    Empire v4.4.1 adds auto-copy clipboard and directory settings in yaml; includes bug fixes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.4.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.4.1

    • Added auto_copy option to listener configurations to automatically copy the staging URL to the clipboard upon listener creation
    • Added download_path, stager_path, and obfuscated_module_path keys to the main .empire/config.yaml file to control where generated artifacts are stored

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed http_mapi.ps1 from the project; any custom listeners or modules referencing this script will fail to load.
    • !Removed support for meterpreter and mapi listener types; existing configurations using these listeners must be migrated to a supported type.
46. 4.4.0 Feb 14, 2022 · release notes

    Empire 4.4.0 adds directory settings to YAML config, C# process injection module, PowerShell bypass YAMls, and Black/Isort integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.4.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 4.4.0

    • directory config keys in YAML for downloads, stagers, and obfuscated_modules paths
    • New C# process injection agent/listener module
    • New bypass configuration YAMls for PowerShell listeners
    • Black and Isort code formatting integration

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Random capitalization function removed from listener configuration (listeners no longer randomize case)
    • !Removed meterpreter and mapi listeners (these listener types are no longer available)
47. v4.3.3 Jan 25, 2022 · release notes

    Adds obfuscation, file upload/download, autostart plugin, Invoke-BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. support, and agent stage2 hooks to Empire CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.3.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.3.3

    • Adds obfuscation options into Empire CLI
    • Adds upload & download options for Empire CLI
    • Adds autostart plugin with options to config file
    • Adds C# server plugin to run on startup
    • Adds Invoke-BOF module

    +2 more show less

    • Added hook for when an agent is fully checked in (stage2)
    • Adds Plugin folders and extensions

    7 details in Everything

48. v4.2.0 Dec 7, 2021 · release notes

    Empire v4.2.0 adds revershell/cmd launchers, IronPython support, SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access./TOR/HTTP pivots, Donut shellcode, and C# VNC server

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.2.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.2.0

    • Adds revershell launcher to the available payload options for agent creation
    • Adds cmd launcher to the available payload options for agent creation
    • Adds IronPython support allowing compilation through Empire with an embedded standard library
    • Adds proxy pivot capabilities (SOCKS, TOR, HTTP) directly within python-based agents
    • Adds a new VNC module backed by a C# implementation for remote desktop access

    +2 more show less

    • Adds extended rights management for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. certificate templates
    • Adds Donut support for generating shellcode from .NET assemblies

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sRDI is removed as a supported method for shellcode delivery
49. v4.1.3 Sep 28, 2021 · release notes

    Empire v4.1.3: New IronPython3 agent and initial filtering/hooking support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.1.3

    • Adds Invoke-IronPython3 module for executing payloads via IronPython3 runtime.
    • Initial release of the filtering/hooking feature in the Empire Client.
    • Adds autocomplete for taskings in the Empire Client with a command to view specific tasks.
    • Adds Python agents to the external/generate_agent module.

    4 details in Everything

50. 4.1.1 Sep 20, 2021 · release notes

    Empire 4.1.1 adds DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. hashdump output function, Python agent generation, and Invoke-IronPython3.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 4.1.1

    └──▷ TRY IT
    Export DCSync hash dump results to a specific output format like JSON or CSV.
    copy

    $ usestarget <target> && usemodule credential_management/dcsync_hashdump OutputFunction JSON

    • Add OutputFunction to dcsync_hashdump
    • Convert file operations to use with syntax
    • Added Invoke-IronPython3 and some OffensiveDLR fixes
    • Added Python agents to the external/generate_agent module

    4 details in Everything

51. 4.1.0 Aug 29, 2021 · release notes

    Empire 4.1.0 adds initial filtering/hooking, autocomplete, and IronPython3 agent support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 4.1.0

    └──▷ HOW TO FIND IT
    Use the new autocomplete to quickly select tasks in the Empire client interface.
    📍In the Empire Client, type task and press Tab to autocomplete tasking options.
    • Adds an initial filtering/hooking feature to the Empire client.
    • Adds autocomplete for taskings in the Empire Client and a command to view a specific task.

    2 details in Everything

52. v4.0.2 Aug 17, 2021 · release notes

    PowerShell Empire v4.0.2 adds socketio messages for agent communication and improves CLI UX

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.0.2

    • Adds socketio message types to enable screenshot, download, and upload operations over the agent listener
    • Adds a help message display when empire.py is invoked without any input arguments

    2 details in Everything

53. v4.0.1 Jul 27, 2021 · release notes

    v4.0.1 adds API sleep/jitter and CLI sleep command for agent control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v4.0.1

    • Adds sleep command to the Empire CLI for configuring agent sleep intervals
    • Adds API endpoints for setting sleep and jitter values on agents

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed old Empire CLI and cmdloop from server
    • !The credential create endpoint now accepts a single credential instead of a list
    • !Some endpoints which were previously throwing 500s when not found, now properly return a 404
    • !Plugin endpoints and socketio channels renamed to plural (plugin -> plugins) to match naming convention of other resources
54. 4.0.0 Jun 28, 2021 · release notes

    Empire 4.0 adds C#/Nim agents, Covenant compatibility, server/client integration and new API/CLI surfaces for bypasses, tasks and credentials.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout 4.0.0

    • Adds a Nim launcher agent type alongside the existing PowerShell and C# agents.
    • Introduces Covenant Task compatibility using the integrated Covenant Roslyn compiler for task compilation.
    • Adds suggested_values support on the server to auto-complete values in the CLI.
    • Adds scriptimport and scriptcommand endpoints to the API for importing and executing scripts remotely.
    • Adds a since query parameter to the /tasks endpoint for efficient filtering of recent tasking results.

    +9 more show less

    • Adds socketio event handlers to the CLI so that tasking results display directly in the interact menu.
    • Adds new bypass management endpoints on the server and corresponding CLI commands to create, update, and remove agents.
    • Introduces a Bypasses field on agent configurations where bypasses are applied in the order provided.
    • Updates credential management with separate GET, UPDATE, and DELETE endpoints plus CLI support for creating, updating, and removing credentials.
    • Adds new modules: Start-ProcessAsUser, NTLM-Extract, Invoke-SharpSecDump, and Invoke-SpoolSample.
    • Adds MS16-051 stager support for generating initial implants.
    • Integrates the Offensive DLR Modules IronPython, ClearScript, and Boolang for dynamic language execution.
    • Updates PowerDump to use AES NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. hashes instead of the legacy RC4 implementation.
    • Simplifies kill/remove commands by adding all and stale options to target multiple agents at once.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The old Empire CLI and cmdloop are removed; use the new integrated server/client interface.
    • !The credential create endpoint now accepts a single credential object instead of a list.
    • !Plugin endpoints and socketio channels are renamed to plural forms (e.g., /plugins instead of /plugin).
55. v3.8.2 Apr 6, 2021 · release notes

    v3.8.0 adds Invoke-SweetPotato module and allows binding the RESTful API to a specific IP.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.8.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.8.2

    • Add ability to specify the bind IP for RESTful API

    1 detail in Everything

56. v3.7.2 Feb 21, 2021 · release notes

    New Empire CLI, malleable C2 profiles directory, and Invoke-WireTap/SauronEye/SharpLoginPrompt listeners

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.7.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.7.2

    └──▷ USE IT
    Specify the team server when generating a launcher payload using the new CLI flag
    shell copy

    ./launcher.py --teamserver <ip>:<port>

    Store custom malleable C2 profiles in the newly added data directory
    shell copy

    cp custom.profile /data/profiles/custom.profile

    Use the new Invoke-WireTap listener module for credential harvesting
    shell copy

    usemodule powershell/credential_stealing/invoke_wiretap

    • Adds --teamserver option to the launcher script for specifying the team server address
    • Introduces new Empire CLI tool available in packaging for managing instances
    • Adds malleable C2 profiles directory at /data/profiles for custom profile storage
    • Includes Invoke-WireTap, Invoke-SauronEye, and Invoke-SharpLoginPrompt as new listener modules

    4 details in Everything

57. v3.6.2 Nov 29, 2020 · release notes

    Empire v3.6.2 adds Python HTTP malleable listeners, new admin API endpoints, Starkiller chat server integration, and the PrivescCheck module.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.6.2

58. v3.6.1 Nov 16, 2020 · release notes

    Adds update_comms, killdate, and workinghours API endpoints to Empire v3.6.1

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.6.1

    └──▷ TRY IT
    Trigger a kill date or update communications via the Empire REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    copy

    $ curl -X POST https://<empire-host>:1337/api/admin/stager/<stager_id>/killdate?date=2024-12-31
    # or for working hours:
    curl -X POST https://<empire-host>:1337/api/admin/stager/<stager_id>/workinghours?start=09:00&end=17:00
    # or to sync comms data:
    curl -X POST https://<empire-host>:1337/api/admin/stager/<stager_id>/update_comms

59. v3.6.0 Nov 9, 2020 · release notes

    Empire v3.6.0 adds API endpoints for notes, multiple redirector listeners, Invoke-Assembly/SharpChisel modules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.6.0

    └──▷ TRY IT
    Attach a note to an agent using the new API endpoints to track operations or context.
    copy

    $ curl -X POST http://<empire_host>:1337/api/users/<agent_uuid>/notes -H "Authorization: Bearer <token>" -d '{"note": "Cobalt Strike migration in progress"}'

    • Adds GET /users/<id>/notes, POST /users/<id>/notes, and similar endpoints to manage user and agent notes via the API
    • Adds support for configuring multiple redirector listeners and chaining them
    • Adds the Invoke-Assembly module for loading .NET assemblies into agents
    • Adds the Invoke-SharpChisel module for C2 tunneling

    4 details in Everything

60. v3.5.0 Oct 13, 2020 · release notes

    Adds Invoke-ZeroLogon and Invoke-SocksProxy listeners plus powercat/powermad modules to Empire v3.5.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.5.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.5.0

    • Adds Invoke-ZeroLogon module for executing the ZeroLogon attack
    • Adds Invoke-SocksProxy listener type for SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxying through a compromised host
    • Adds powercat netcat-like network transfer module
    • Adds powermad modules for creating computer accounts and other Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. manipulation

    4 details in Everything

61. v3.4.0 Sep 16, 2020 · release notes

    Empire 3.4.0 adds Malleable C2 HTTP Listener, startup plugins, and several new modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.4.0

    • Added Malleable C2 HTTP Listener support for traffic obfuscation
    • Added ability to reflectively load files into memory
    • Added Invoke-DomainPasswordSpray module for password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password. attacks
    • Added Invoke-WinPEAS module for privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. auditing
    • Added Invoke-Watson module for kernel exploit detection

    +2 more show less

    • Added support for loading plugins at startup
    • Updated Slack API notifications to use webhooks

    7 details in Everything

62. v3.3.3 Aug 12, 2020 · release notes

    Empire v3.3.3 adds get_gpo_computer and port forwarding modules plus custom command options for lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.3.3

    └──▷ TRY IT
    List computers targeted by Group Policy Objects during a red team assessment.
    copy

    $ invoke module get_gpo_computer

    Forward local port 8080 to a remote host via the agent.
    copy

    $ invoke module port_forwarding --localport 8080 --remotehost <target> --remoteport 443

    Execute a custom command via DCom instead of the default payload.
    copy

    $ invoke module invoke_dcom --custom_command 'whoami'

    • Adds get_gpo_computer module to retrieve GPO-associated computers.
    • Adds port_forwarding module to establish port forwards from the agent.
    • Updates invoke_smbexec, invoke_dcom, invoke_executemsbuild, and invoke_wmi lateral movement modules to include an option for custom commands.

    3 details in Everything

63. v3.3.0 Jul 10, 2020 · release notes

    Empire v3.3.0 adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. integration, AMSI bypass options, Invoke-Rubeus, and Filescraper commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.3.0

    • Adds Invoke-Rubeus module for KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. scenarios
    • Adds Filescraper commands for file enumeration on compromised hosts
    • Adds keyword obfuscation option to modules via a new configuration parameter
    • Adds AMSIBypass option to modules that generate new agents
    • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Attack Techniques/Software mapping functionality

    5 details in Everything

64. v3.2.3 Jun 8, 2020 · release notes

    Empire v3.2.3 adds Invoke-Seatbelt module, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. metadata, and timezone-aware timestamps

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.3 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.2.3

    └──▷ TRY IT
    Execute Seatbelt system information gathering on a compromised Windows host via Empire
    copy

    $ (listener) execute module powershell/lateral_movement/invoke_seatbelt with TargetHost=192.168.1.50

    • Invoke-Seatbelt module allows running Seatbelt gathering techniques directly from Empire listeners
    • Modules now include mitre_technique and mitre_software fields for ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. mapping
    • All listener and agent communication timestamps are now timezone-aware (previously naive UTC)

    3 details in Everything

65. v3.2.2 May 26, 2020 · release notes

    Adds Invoke-PrintDemon module and plugin API endpoints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.2 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.2.2

    • Added Invoke-PrintDemon module for printing-related attacks
    • Added API endpoints for plugins

    2 details in Everything

66. v3.2.1 May 11, 2020 · release notes

    Empire v3.2.1 adds non-elevated Mimikatz execution capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.1 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.2.1

    • Adds option to run Mimikatz commands as a non-elevated user

    1 detail in Everything

67. v3.2.0 Apr 27, 2020 · release notes

    Empire v3.2.0 adds SharpChromium and BloodHound 3 modules, single-user API endpoint, and Python 3 conversion.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.2.0

    • Added SharpChromium module for credential harvesting from Chromium-based browsers
    • Added BloodHound 3 module for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. visualization
    • Adds prompt confirmation before running --reset script via the admin panel
    • Converted python modules from Python 2 to Python 3 formatting

    4 details in Everything

68. v3.1.4 Apr 6, 2020 · release notes

    Empire v3.1.4 adds a reset flag to the launcher and updates payload evasion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.4 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.1.4

    • Adds --reset flag to the empire launcher to clear previous state
    • Updates payload evasion logic against Microsoft Defender

    2 details in Everything

69. v3.1.0 Mar 2, 2020 · release notes

    Empire v3.1.0 adds multi-user API collaboration, function aliasing, and an expanded API surface.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

    • Adds Multi-user Collaboration support to the Empire API endpoint
    • Adds function name aliasing capability to Invoke-Empire and Mimikatz listeners
    • Expands overall API functionality for broader integration capabilities

    3 details in Everything

70. v3.0.6 Jan 31, 2020 · release notes

    Adds stale property to agents API and relaxes staging key length requirement

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.6 https://github.com/BC-SECURITY/Empire.git
    # already have the repo? check out this version:
    $ git checkout v3.0.6

    └──▷ TRY IT
    Check if an agent is considered stale via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.
    copy

    $ curl -k https://<empire-host>:1337/api/agents | jq '.results[].stale'

    • stale property now returned in the agents endpoint response
    • Staging key validation relaxed to allow lengths other than exactly 32 characters

    2 details in Everything