powershell-empire — The Cyber Toolchain

powershell-empire v7.0.2

Tue, 08 Sep 2026 14:45:24 GMT

Empire v7 adds 30+ BOF modules, AES-256-GCM, chunked uploads, persistent chdir, and a new `ps-empire update` subcommand⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `./ps-empire update` subcommand that moves the checkout to the latest release tag, refreshes `config.yaml`, fast-forwards Starkiller, the plugin registry, and the Empire Compiler binary, and applies pending Alembic migrations; use `-y` to auto-confirm the backup prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `starkiller.directory` config option to serve an already-built Starkiller instead of cloning from GitHub, enabling air-gapped and distro-packaged installs. • Adds `POST /api/v2/agents/{id}/tasks/chdir` endpoint and `TASK_CHDIR` (opcode 44) for persistently changing an agent's working directory across PowerShell, Python, and IronPython agents. • Adds chunked file uploads to agents — files split into 512KB chunks drip-fed across checkins — removing the previous 1MB upload limit with backward-compatible protocol detection. • Adds AES-256-GCM across the stack: an `AES256GCM` AEAD class in `encryption.py` (server), `agent/stagers/common/aesgcm.py` for Python/IronPython stagers, and a .NET 4.x `AesGcmHelper` for PowerShell stagers. • Adds `MergeReferences` option to the C# module YAML schema, enabling ILRepack dependency merging via the Empire Compiler `--merge-references` flag. • Adds `InjectSelf` option (default `true`) to `inject_amsi_bypass` and `inject_etw_bypass` — set `false` to target a remote PID instead of the agent's own process. • Adds `SafeChecksPS` / `SafeChecksPython` bypass YAMLs consolidating bypass snippets; opt in via a stager's `Bypasses` parameter. • Adds parser support for the Cobalt Strike `http-config` block in malleable HTTP listeners, wiring `trust_x_forwarded_for` (default `false`) and `block_useragents` (fnmatch globs). • Adds a `krb_session_key` credential type storing Rubeus session keys as `:`, captured from both `dump` and `asktgt`/`asktgs` output. • Adds a per-option `format_string` override and `{{ VALUE_ARRAY }}` token for rendering PowerShell `[Array]` parameters as double-quoted, comma-joined elements. • Adds `AFTER_CHAT_MESSAGE_HOOK` core hook fired with (db, message: ChatMessage) after a chat message is persisted, enabling plugins to observe chat traffic. • Adds a downloadable chatlog report via `report=chat` (included in `report=all`), exporting `chatlog.csv`; chat is now persisted to a new `chat_messages` table (Alembic migration `0003`) and `chat/history` returns the most recent 20 messages. • Adds an Inveigh credential parser (`situational_awareness/host/inveigh`) that ingests NetNTLMv1/v2 hashes from task output, tagging machine accounts as `inveigh machine_account`. • Adds SharpHound C# module for BloodHound Active Directory enumeration with ILRepack assembly merging. • Adds situational-awareness modules `powershell/situational_awareness/host/{processes,ipconfig,route,dir_list}` and `python/situational_awareness/host/processes`, emitting JSON for server-side filters. • Adds `wdtoggle` BOF module to patch WDigest/Credential Guard in LSASS to re-enable plaintext credential caching. • Adds `psx` BOF module for a process list annotated with detected security products (AV/EDR/logging tools). • Adds `psm` BOF module for detailed single-process info by PID — loaded modules, TCP connections, and RDP sessions. • Adds `psk` BOF module to enumerate loaded kernel modules/drivers annotated with security-product driver detection. • Adds `psw` BOF module to enumerate window titles across running processes. • Adds `psc` BOF module for a process list with active TCP connections and RDP session details. • Adds `winver` BOF module to retrieve Windows version, build number, and patch revision of the target host. • Adds `netuse_add`, `netuse_list`, and `netuse_delete` BOF modules for mapping shares, enumerating connections, and disconnecting mapped drives. • Adds `sc_enum` BOF module to bulk-enumerate all services on a local or remote host via SCM (config, query, failure, and trigger data). • Adds `sc_qc` BOF module to query a Windows service's configuration (binary path, start type, account, dependencies) via SCM. • Adds `sc_qdescription` BOF module to query a Windows service's description via SCM. • Adds `sc_qfailure` BOF module to query a Windows service's failure actions (restart, run command, reboot) via SCM. • Adds `sc_qtriggerinfo` BOF module to query the trigger events that start or stop a Windows service. • Adds `netuserenum` BOF module to enumerate local or domain user accounts via `NetUserEnum` with a configurable filter. • Adds `nslookup` BOF module for DNS lookups via the Windows DNS client API, with optional custom server and record type. • Adds `notepad` BOF module to enumerate open Notepad/Notepad++ windows and extract the displayed file path or in-memory text. • Adds `findLoadedModule` BOF module to enumerate processes that have a given module (DLL substring) loaded — useful for locating injection targets and fingerprinting EDR. • Adds `vssenum` BOF module to enumerate Volume Shadow Copies exposed on a host's SMB share, useful for locating offline SAM/SYSTEM/NTDS hives. • Adds `addmachineaccount` BOF module for adding machine accounts (lateral movement). • Adds `nonpaged_ldapsearch` BOF module for synchronous non-paged LDAP queries against a domain controller, useful when paged queries are throttled. • Adds `ldapsearch` BOF module for LDAP/LDAPS queries against a domain controller with configurable scope. • Adds `reg_query` BOF module for in-agent Windows registry queries — key enumeration, value lookup, and recursive traversal — on local or remote systems. • Adds `etw_patching` BOF module to patch or revert `EtwEventWrite` in ntdll to degrade ETW logging in-process. • Adds `static_syscalls_dump` BOF module to dump a target process's memory via static syscall numbers, bypassing ntdll hooks. • Adds `static_syscalls_inject` BOF module to inject shellcode into a remote process via static syscalls. • Adds `static_syscalls_apc_spawn` BOF module to spawn a temporary process and inject shellcode via APC queue using static syscalls. • Adds `syscalls_shellcode_injection` BOF module to inject shellcode into a remote process via direct syscalls. • Adds `reconad` BOF module for ADSI-based Active Directory reconnaissance. • Adds `domaininfo` BOF module to report AD domain membership and Azure AD join status of the host. • Adds `smbinfo` BOF module to retrieve SMB server info via `NetServerGetInfo`. • Adds `findmodule` BOF module to find processes with a given module (DLL) loaded. • Adds `findprochandle` BOF module to find processes holding a handle to a named object. • Adds `startwebclient` BOF module to start the WebClient service via ETW trigger registration. • Adds `lapsdump` BOF module to dump LAPS passwords (`ms-Mcs-AdmPwd`) from AD via LDAP. Breaking changes: • Password hashing switched from bcrypt to PBKDF2-HMAC-SHA256 (600K iterations); existing bcrypt hashes are incompatible — reset passwords or recreate the database. Non-default bcrypt users must be manually reset via `PUT /api/v2/users/{id}/password`. • Staging key normalization replaced MD5 with SHA-256; agents staged under the old algorithm must be re-staged. • CSPRNG generation replaced `random` with `secrets` (server) and random.SystemRandom() (agent) across listeners, stagers, agents, and utilities; all deployed agents must be re-staged. • `./ps-empire update` overwrites the base `config.yaml` on every run — move local customizations to `config.user.yaml` before upgrading. • Debian 11 (bullseye) is no longer a supported install platform; it has been removed from the install script, CI matrix, and docs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v7.0.2

Tue, 08 Sep 2026 14:45:24 GMT

Empire v7 adds 30+ BOF modules, AES-256-GCM, chunked uploads, persistent chdir, and a new `ps-empire update` subcommand⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `./ps-empire update` subcommand that moves the checkout to the latest release tag, refreshes `config.yaml`, fast-forwards Starkiller, the plugin registry, and the Empire Compiler binary, and applies pending Alembic migrations; use `-y` to auto-confirm the backup prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `starkiller.directory` config option to serve an already-built Starkiller instead of cloning from GitHub, enabling air-gapped and distro-packaged installs. • Adds `POST /api/v2/agents/{id}/tasks/chdir` endpoint and `TASK_CHDIR` (opcode 44) for persistently changing an agent's working directory across PowerShell, Python, and IronPython agents. • Adds chunked file uploads to agents — files split into 512KB chunks drip-fed across checkins — removing the previous 1MB upload limit with backward-compatible protocol detection. • Adds AES-256-GCM across the stack: an `AES256GCM` AEAD class in `encryption.py` (server), `agent/stagers/common/aesgcm.py` for Python/IronPython stagers, and a .NET 4.x `AesGcmHelper` for PowerShell stagers. • Adds `MergeReferences` option to the C# module YAML schema, enabling ILRepack dependency merging via the Empire Compiler `--merge-references` flag. • Adds `InjectSelf` option (default `true`) to `inject_amsi_bypass` and `inject_etw_bypass` — set `false` to target a remote PID instead of the agent's own process. • Adds `SafeChecksPS` / `SafeChecksPython` bypass YAMLs consolidating bypass snippets; opt in via a stager's `Bypasses` parameter. • Adds parser support for the Cobalt Strike `http-config` block in malleable HTTP listeners, wiring `trust_x_forwarded_for` (default `false`) and `block_useragents` (fnmatch globs). • Adds a `krb_session_key` credential type storing Rubeus session keys as `:`, captured from both `dump` and `asktgt`/`asktgs` output. • Adds a per-option `format_string` override and `{{ VALUE_ARRAY }}` token for rendering PowerShell `[Array]` parameters as double-quoted, comma-joined elements. • Adds `AFTER_CHAT_MESSAGE_HOOK` core hook fired with (db, message: ChatMessage) after a chat message is persisted, enabling plugins to observe chat traffic. • Adds a downloadable chatlog report via `report=chat` (included in `report=all`), exporting `chatlog.csv`; chat is now persisted to a new `chat_messages` table (Alembic migration `0003`) and `chat/history` returns the most recent 20 messages. • Adds an Inveigh credential parser (`situational_awareness/host/inveigh`) that ingests NetNTLMv1/v2 hashes from task output, tagging machine accounts as `inveigh machine_account`. • Adds SharpHound C# module for BloodHound Active Directory enumeration with ILRepack assembly merging. • Adds situational-awareness modules `powershell/situational_awareness/host/{processes,ipconfig,route,dir_list}` and `python/situational_awareness/host/processes`, emitting JSON for server-side filters. • Adds `wdtoggle` BOF module to patch WDigest/Credential Guard in LSASS to re-enable plaintext credential caching. • Adds `psx` BOF module for a process list annotated with detected security products (AV/EDR/logging tools). • Adds `psm` BOF module for detailed single-process info by PID — loaded modules, TCP connections, and RDP sessions. • Adds `psk` BOF module to enumerate loaded kernel modules/drivers annotated with security-product driver detection. • Adds `psw` BOF module to enumerate window titles across running processes. • Adds `psc` BOF module for a process list with active TCP connections and RDP session details. • Adds `winver` BOF module to retrieve Windows version, build number, and patch revision of the target host. • Adds `netuse_add`, `netuse_list`, and `netuse_delete` BOF modules for mapping shares, enumerating connections, and disconnecting mapped drives. • Adds `sc_enum` BOF module to bulk-enumerate all services on a local or remote host via SCM (config, query, failure, and trigger data). • Adds `sc_qc` BOF module to query a Windows service's configuration (binary path, start type, account, dependencies) via SCM. • Adds `sc_qdescription` BOF module to query a Windows service's description via SCM. • Adds `sc_qfailure` BOF module to query a Windows service's failure actions (restart, run command, reboot) via SCM. • Adds `sc_qtriggerinfo` BOF module to query the trigger events that start or stop a Windows service. • Adds `netuserenum` BOF module to enumerate local or domain user accounts via `NetUserEnum` with a configurable filter. • Adds `nslookup` BOF module for DNS lookups via the Windows DNS client API, with optional custom server and record type. • Adds `notepad` BOF module to enumerate open Notepad/Notepad++ windows and extract the displayed file path or in-memory text. • Adds `findLoadedModule` BOF module to enumerate processes that have a given module (DLL substring) loaded — useful for locating injection targets and fingerprinting EDR. • Adds `vssenum` BOF module to enumerate Volume Shadow Copies exposed on a host's SMB share, useful for locating offline SAM/SYSTEM/NTDS hives. • Adds `addmachineaccount` BOF module for adding machine accounts (lateral movement). • Adds `nonpaged_ldapsearch` BOF module for synchronous non-paged LDAP queries against a domain controller, useful when paged queries are throttled. • Adds `ldapsearch` BOF module for LDAP/LDAPS queries against a domain controller with configurable scope. • Adds `reg_query` BOF module for in-agent Windows registry queries — key enumeration, value lookup, and recursive traversal — on local or remote systems. • Adds `etw_patching` BOF module to patch or revert `EtwEventWrite` in ntdll to degrade ETW logging in-process. • Adds `static_syscalls_dump` BOF module to dump a target process's memory via static syscall numbers, bypassing ntdll hooks. • Adds `static_syscalls_inject` BOF module to inject shellcode into a remote process via static syscalls. • Adds `static_syscalls_apc_spawn` BOF module to spawn a temporary process and inject shellcode via APC queue using static syscalls. • Adds `syscalls_shellcode_injection` BOF module to inject shellcode into a remote process via direct syscalls. • Adds `reconad` BOF module for ADSI-based Active Directory reconnaissance. • Adds `domaininfo` BOF module to report AD domain membership and Azure AD join status of the host. • Adds `smbinfo` BOF module to retrieve SMB server info via `NetServerGetInfo`. • Adds `findmodule` BOF module to find processes with a given module (DLL) loaded. • Adds `findprochandle` BOF module to find processes holding a handle to a named object. • Adds `startwebclient` BOF module to start the WebClient service via ETW trigger registration. • Adds `lapsdump` BOF module to dump LAPS passwords (`ms-Mcs-AdmPwd`) from AD via LDAP. Breaking changes: • Password hashing switched from bcrypt to PBKDF2-HMAC-SHA256 (600K iterations); existing bcrypt hashes are incompatible — reset passwords or recreate the database. Non-default bcrypt users must be manually reset via `PUT /api/v2/users/{id}/password`. • Staging key normalization replaced MD5 with SHA-256; agents staged under the old algorithm must be re-staged. • CSPRNG generation replaced `random` with `secrets` (server) and random.SystemRandom() (agent) across listeners, stagers, agents, and utilities; all deployed agents must be re-staged. • `./ps-empire update` overwrites the base `config.yaml` on every run — move local customizations to `config.user.yaml` before upgrading. • Debian 11 (bullseye) is no longer a supported install platform; it has been removed from the install script, CI matrix, and docs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v6.6.0

Thu, 28 May 2026 03:30:55 GMT

Empire v6.6.0 adds 49 ATT&CK-mapped modules, 8 new BOFs (including nanodump & bofroast), a pre-obfuscation API endpoint, and Alembic DB migrations. • Adds `nanodump` BOF module for LSASS minidump creation using multiple evasion techniques (handle duplication, process forking, snapshot, seclogon handle leaking). • Adds 7 new BOF modules from Sliver Armory: `unhook` (EDR/AV API hook removal), `patchit` (AMSI+ETW all-in-one), `inject_amsi_bypass`, `inject_etw_bypass`, `credman` (Credential Manager dump), `handlekatz` (LSASS via handle duplication), and `bofroast` (CLR-free Kerberoasting). • Adds multi-language stager support (powershell, csharp, ironpython, go) to UAC bypass modules: `bypassuac`, `bypassuac_env`, `bypassuac_eventvwr`, `bypassuac_sdctlbypass`, `bypassuac_wscript`. • Adds `POST /api/v2/obfuscation/modules/preobfuscate` endpoint to trigger background pre-obfuscation of specific modules by ID (returns HTTP 202). • Adds Alembic database migration framework for versioned schema management, including migrate_db() and backup_db() helper functions. • Adds configurable MySQL connection pool settings (`pool_size`, `max_overflow`, `pool_pre_ping`, `pool_recycle`) via server config YAML, with pool health monitoring that warns at 80% capacity. • Adds configurable `obfuscation.timeout` setting (default 300s, disable with 0) for the PowerShell obfuscation subprocess, configurable via `config.yaml` or `EMPIRE_OBFUSCATION__TIMEOUT` env var. • Adds `./ps-empire test` command as a convenience wrapper for pytest with passthrough arguments. • Adds `strict` and `suggested_values` fields to boolean switch options in modules for improved validation and UI hints. • Adds dynamic `depends_on` support to stagers so dependent fields (`Bypasses`, `Obfuscate`, `ObfuscateCommand`) show or hide based on the selected listener type. • Updates Starkiller to v3.5.0. Breaking changes: • The legacy `archive` field is removed from `empire_compiler` config; replace it with `repo` and `ref`. • High-frequency hooks (`AFTER_AGENT_CALLBACK_HOOK`, `AFTER_TASKING_RESULT_HOOK`, `AFTER_AGENT_CHECKIN_HOOK`, `AFTER_TASKING_HOOK`) now receive `None` as the session argument instead of an active session — any hook code that uses the passed session directly will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v6.5.0

Sun, 05 Apr 2026 18:14:09 GMT

Empire v6.5.0 adds C stagers with shellcode compilation, six new offensive modules, and a runtime Background option for C# tasks. • Adds a C stager for lightweight stage0 shellcode injection via Fibers • Adds `shellcode_compiler` utility to compile position-independent C stagers into raw x64 shellcode for BOF process injection • Adds `clipboard_window_inject_list` BOF module for enumerating processes with clipboard window class • Adds a runtime `Background` option to C# modules, letting operators override background/foreground execution at task time • Adds C# `PatchETW` module for in-process ETW patching via ntdll!EtwEventWrite • Adds C# `PatchlessAMSI` module for patchless AMSI bypass using hardware breakpoints and vectored exception handling • Adds PowerShell `Invoke-VSSExtract` module for NTDS.dit and SYSTEM hive extraction via Volume Shadow Copy • Adds PowerShell `Invoke-RDPHijack` module for RDP session hijacking via tscon.exe • Adds Python `linux_keyring` module for credential extraction from the Linux kernel keyring subsystem • Adds Python `aws_imds` module for AWS IAM role credential theft via EC2 Instance Metadata Service • Adds BOF `spawn` module for EarlyBird process hollowing with suspended process creation, shellcode injection, and APC thread hijacking • Logs Empire version and git commit SHA at startup for easier production diagnostics; SHA is baked into Docker images via `--build-arg` • Adds Python 3.14 support (3.13 and 3.14); Dockerfile now uses `python:3.14.3-trixie` • Refactors `bof_packer` into a `Packer` class with granular packing methods (`addbytes`, `addstr`, `addWstr`, `addbool`, `adduint32`, `addint`, `addshort`) • Adds format_bof_output() to `ModuleService` to centralize BOF output formatting for Go and .NET agents Breaking changes: • The `secinject` BOF module and its pre-compiled binary have been removed; any playbooks or profiles referencing it will break. • `stager_generation_service` now uses `install_path` (Path) instead of the deprecated `installPath` (str); any code or plugins referencing `installPath` on this service will break. • All remaining core usages of `installPath` have been migrated to `install_path` (Path); external plugins or integrations that reference `installPath` on core services will break. • The `terminaltables` dependency has been replaced with `prettytable`; code or plugins that import `terminaltables` directly will break. • `bof_packer` standalone functions have been replaced by a `Packer` class API; any code calling the old standalone functions will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v6.4.1

Mon, 16 Feb 2026 17:39:19 GMT

Empire v6.4.1 adds config layering, auto-install plugins, Socket.IO toggle, and a new C# spawn module. • Adds `config.user.yaml` layering: drop a file next to `config.yaml` to override specific settings without touching the base config. • Adds `auto_install` option to `plugin_marketplace` config for automatic plugin installation at setup time. • Adds `server.socketio` config option to disable Socket.IO (enabled by default). • Adds C# spawn module supporting both PowerShell and C# executables. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 6.4.0

Sun, 18 Jan 2026 00:00:00 GMT

Empire 6.4.0 adds clipboard enumeration via WinRT, background task tracking, and new API/CLI surfaces • Adds `Get-ClipboardHistory` PowerShell module to enumerate Windows clipboard history on Windows 10/11 via WinRT APIs • Adds `-c` (compile from source) and `-o` (override) options to the `ps-empire` CLI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v6.3.0

Fri, 12 Dec 2025 03:30:21 GMT

Empire v6.3.0 adds mTLS agent support, ChaCha20-Poly1305 routing encryption, multi-language PSexec payloads, and customizable C# obfuscation. • Adds mTLS support to agents and listeners for mutual certificate-based authentication. • Upgrades routing packet encryption from RC4 to ChaCha20-Poly1305 for authenticated encryption. • Exposes all agent language options (C#, IronPython, Go, PowerShell) in PSexec payload selection. • Adds customizable C# obfuscation via ConfuserEx XML config through EmpireCompiler v0.4.1. • Supports overriding all Empire config values with environment variables. • Changes PowerShell agent key exchange from RSA to Diffie-Hellman. • Moves default bypasses from individual stagers/modules into centralized config. • Allows the HTTPS `host` value to be used on HTTP and malleable listeners without requiring a cert path. Breaking changes: • RC4 is no longer used to deliver routing packets to agents — agents and listeners must both be on v6.3.0 for the ChaCha20-Poly1305 encrypted routing to be compatible. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v6.2.0

Tue, 02 Sep 2025 04:17:35 GMT

Empire v6.2.0 adds server clean/reset options, Go agent support for spawn/spawnas, multi-language fodhelper, and alternative auth header. • Adds `clean` and `reset` options to the Empire server for easier environment management. • Adds Go agent support to the `spawn` and `spawnas` modules. • Extends `fodhelper` UAC bypass to support additional agent languages beyond the previous default. • Supports `X-Empire-Token` as an alternative authentication header to `Authorization` for Empire API requests. • Updates Starkiller to v3.1.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v6.1.2

Wed, 21 May 2025 07:16:47 GMT

Empire v6.1.2 adds Ubuntu 24.04 support to the install script. • Supports Ubuntu 24.04 in the install script. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v6.0.3

Thu, 24 Apr 2025 22:26:51 GMT

PowerShell Empire 6.0.3 adds literal interpretation for shell commands in the IronPython agent. • Adds literal interpretation mode for shell commands in the IronPython agent. Breaking changes: • Linux is removed as a Go agent target option. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v6.0.0

Tue, 25 Mar 2025 04:02:58 GMT

Empire v6.0.0 adds Go agents, a Plugin Marketplace, a new Empire Compiler for C#, and expanded IP allow/deny list support. • Adds Go agents with a new `multi_go_exe` stager type and Go as an option for `multi_launcher`. • Introduces a Plugin Marketplace via Starkiller 3.0 with support for plugin registries and installing plugins via the API. • Replaces the old C# compilation approach with a new Empire-Compiler that auto-downloads pre-compiled binaries, eliminating `dotnet` as an OS dependency. • Adds new allow/deny list implementation with proper support for IPv4, IPv6, ranges, and CIDRs. • Adds API endpoints for managing autorun commands on agent check-in. • Adds `api.ip` and `api.secure` as server config options. • Adds dynamic options to modules. • Adds module `code_execution/invoke-script` for remote PowerShell script execution. • Adds module `python/code_execution/invoke-script` for remote Python script execution. • Adds SharpHound ingestor for Community Edition and tags legacy BloodHound. • Adds language compatibility check so modules only run on agents that support the required language. • Adds `-f` flag to the install script to force installation as root. • Swaps C# module RunOF for COFFLoader. • Updates BOF parsing to use `bof_pack` formatting. • Updates Starkiller to v3.0.0, now served at `{api_url}/`. Breaking changes: • The command line client has been removed; use Starkiller instead. • `--restip` and `--restport` command-line options are removed; use the config file instead. • `socketport` config option on the client is removed. • All config properties in client and server configs are renamed to snake_case. • `ip_whitelist` and `ip_blacklist` are renamed to `ip_allow_list` and `ip_deny_list` and are now lists instead of comma-separated strings. • Starkiller is now accessed at `{api_url}/` instead of `{api_url}/index.html`. • The `Agents` class is moved to `AgentCommunicationService` with refactored function and parameter names. • The `Stagers` class is moved to `StagerGenerationService` with refactored function and parameter names. • Plugin Task handling is moved from `PluginService` to `PluginTaskService`. • Socks management is moved to `AgentSocksService` with socks properties renamed to use plural naming. • The `update_lastseen` parameter is removed from `handle_agent_request`. • `module_service.execute_module` now returns a pydantic model. • `agent_task_service` functions now take a user model instead of a user ID. • All writable data is moved out of the install path into `~/.local/share/empire`. • The `Listeners` class is removed. • The `Credentials` class is removed. • Functions from the `Agents` class deprecated in 5.x are removed. • Script and module upload to memory is removed in favor of modules with the same functionality. • The `reverseshellserver` plugin is removed. • `empire_config.directories.module_source` and `empire_config.directories.obfuscated_module_source` config keys are removed. • The `csharpserver` plugin is replaced by the `DotnetCompiler` class in `empire.server.common`. • The `nim` stager is removed from Empire and the install script. • Minimum Python version raised to 3.13. • Removed listeners: HTTP COM, OneDrive, and Dropbox. • Removed stagers: `osx/pkg`, `windows/backdoorlnkmacro`, `windows/launcher_lnk`, `windows/launcher_sct`, `windows/ms16-051`, `windows/reverseshell`. • All C# module code has been moved as submodules of Empire-Compiler. • Debian 10 is no longer supported by the install script. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.12.0

Sat, 14 Dec 2024 19:42:37 GMT

Empire v5.12.0 adds Python 3.13 support and system-wide deployment capability. • Supports Python 3.13 as a valid runtime. • Enables system-wide deployment of Empire for multi-user environments. • Automatically falls back to ~/.empire directory when config.yaml paths lack write permission, and updates config.yaml accordingly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.11.4

Wed, 04 Sep 2024 04:36:09 GMT

Empire v5.11.4 adds nameserver enumeration check for Linux hosts. • Adds nameserver check for Linux hosts to expand host reconnaissance capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.11.2

Thu, 08 Aug 2024 19:16:44 GMT

Empire v5.11.2 adds ThreadlessInject, Invoke-BSOD modules and ticketdumper; this minor release is a bug-fix only patch. • Adds `ThreadlessInject` module for in-memory process injection without allocating executable memory pages. • Adds `Invoke-BSOD` module to trigger a Blue Screen of Death on compromised hosts. • Adds `ticketdumper` IronPython module for extracting Kerberos tickets from memory. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.11.0

Sun, 14 Jul 2024 00:00:00 GMT

Empire 5.11 adds Invoke-BSOD, ticketdumper, ThreadlessInject modules and threaded powershell job execution • Adds `Invoke-BSOD` module to trigger blue screen of death scenarios for testing. • Adds `ticketdumper` IronPython module for credential extraction via Kerberos tickets. • Adds `ThreadlessInject` module for in-memory code injection without writing to disk. • Adds threaded job execution for PowerShell tasks using AppDomains to improve concurrency and reliability. • Adds detailed job tracking for all tasks within the Sharpire system instead of only tracking jobs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.10.3

Thu, 23 May 2024 00:00:00 GMT

Empire 5.10.3 updates default behaviors for SharpUp, Seatbelt, and SharpWMI/S sharpsc, and adds --debug to Moriarty. • Updates the `--action` default for SharpSC modules to `query service=` for broader enumeration • Adds `--debug` flag support to Moriarty listeners to enable verbose logging during agent check-ins • Changes SharpWMI module default action from `execute` to `query` reducing execution noise Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.10.1

Fri, 03 May 2024 01:55:40 GMT

Empire v5.10 adds Moriary module, callback socket messages, and sacrificial process spawning via BoF. • `Moriary` module added for threat hunting • Adds hook and socket message to receive callback messages for individual agents • Added sacrificial Spawn Process bof • `./ps-empire` install option added • Added .NET 4.5 compile option Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.10.0

Mon, 08 Apr 2024 00:00:00 GMT

Empire 5.10 adds callback hooks, Moriary module, and non-root log permissions. • `--auto-pull` submodule option enables automatic updates on startup • New `install` subcommand in `./ps-empire` bootstrap script • Moriary PowerShell Empire module adds new tasking capabilities • Non-root file permissions applied to empire and listener logs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.9.3

Fri, 09 Feb 2024 03:52:00 GMT

v5.9.3 adds Excel/Word selection and AutoOpen/AutoClose options to windows_macro stager • `windows_macro` stager now supports `--excel`/`--word` flags to select the Office application and `--autoopen`/`--autoclose` flags to control macro execution timing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.9.1

Thu, 25 Jan 2024 05:49:30 GMT

Adds BOF modules (nanodump, secinject, etc.), YAML module format, and custom certificate path config • Adds `BOF` modules to Empire as yaml files, including ClipBoardWindow-Inject, nanodump, secinject, tgtdelegation, and TrustedSec's SA modules • Adds support for returning validation/execution exceptions (`ModuleValidationException`, `ModuleExecutionException`, `PluginValidationException`, `PluginExecutionException`) from module and plugin generate/execute functions • Adds decorators for module generate functions to automatically get the `module_source` and call `finalize_module` • Adds custom certificate path configuration via `server_config.yaml` • Updates install script and Docker file to use Python 3.12.1 Breaking changes: • Returning tuples from module generate functions is deprecated; raise `ModuleValidationException` for 400 errors and `ModuleExecutionException` for 500 errors instead of using `handle_error_message` • Returning tuples from plugin execution functions is deprecated; raise `PluginValidationException` for 400 errors and `PluginExecutionException` for 500 errors • Loading plugins from a `.plugin` file is deprecated; use a `.py` file with a `plugin.yaml` instead • Extending the `Plugin` class is deprecated; use the `BasePlugin` class instead • Plugins must now have a `plugin.yaml`; the Base plugin class is now `BasePlugin` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.9.0

Sat, 20 Jan 2024 00:00:00 GMT

Empire 5.9.0 adds YAML-based BOF modules and custom cert path to server config • Adds `custom_certificate_path` key to `server_config.yaml` to specify the TLS certificate location for the Empire server • Adds support for Beacon Object Files (BOFs) as YAML modules, enabling immediate use of ClipBoardWindow-Inject, nanodump, secinject, tgtdelegation, and TrustedSec's SA modules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.8.1

Mon, 04 Dec 2023 06:21:05 GMT

v5.8.1 adds `tags` search to credentials API endpoints and lets users disable Starkiller. • `config.yaml` now accepts the `Starkiller.enabled` key (default `true`) to toggle the web UI on or off • Credentials API endpoints (`/api/credentials`, `/api/agents/:agent_id/creds`) accept a `tags` query parameter to filter results Breaking changes: • Pydantic upgrade to v2 may require updates to custom validation logic if the tool's Python modules use Pydantic directly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.7.3

Tue, 17 Oct 2023 04:09:48 GMT

Adds a post-staging bypass module and updates Starkiller to v2.6.1 in Empire v5.7.3 • Adds a new `bypass` module that executes PowerShell bypasses after an agent is successfully staged. • Updates the Starkiller web interface to version 2.6.1. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.6.3

Sun, 27 Aug 2023 22:09:27 GMT

Empire v5.6.3 adds Advanced Reporting Plugin; v5.6.0 introduces tagging system with REST endpoints and UI filters. • `v5.6.0` Adds tags to Listeners, Agents, Agent Tasks, Plugin Tasks, Credentials, and Downloads • `v5.6.0` Adds API endpoints to add, edit, and delete tags for each resource type • `v5.6.0` Adds tag list endpoint (`GET /tags`) • `v5.6.0` Adds tag filters to Agent Tasks, Plugin Tasks, and Downloads queries • `v5.6.0` Adds events for new and updated tags • `v5.6.0` Adds `Invoke-PhishingLNK` Module • `v5.6.3` Adds Advanced Reporting Plugin and dependencies Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.6.0

Tue, 25 Jul 2023 00:00:00 GMT

Empire 5.6.0 adds tagging across resources and a new Invoke-PhishingLNK module • Add tags to Listeners, Agents, Agent Tasks, Plugin Tasks, Credentials, and Downloads • Add endpoints to add, edit, and delete tags for each resource type • Add tag list endpoint • Add tag filters to Agent Tasks, Plugin Tasks, and Downloads • Add events for new and updated tags • Allow download_service to accept a pathlib.Path object to create a download Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.5.3

Thu, 20 Jul 2023 05:29:09 GMT

Empire v5.5.0 adds agent checkins API endpoints, Malleable Profile reloads, and multiple new Python-based modules. • Adds `checkins` endpoint to retrieve agent checkin history as a list • Adds `checkins/aggregate` endpoint to get aggregated checkin data (excluded with SQLite) • Adds Python agent support to the hop listener for staging • Adds IronPython SMB Agents/Listener • Adds LinPEAS to Python modules • Adds Python obfuscation capability using `python-obfuscator` • Expands file options configuration across plugins, stagers, and listeners Breaking changes: • Aggregate endpoint `checkins/aggregate` is not supported with SQLite; using SQLite for this feature will fail. • Removed .NET Core modules due to errors • Removed redundant C# lateral movement modules • Removed Covenant Mimikatz in favor of Invoke-Mimikatz • Removed Invoke-Assembly in favor of Covenant's execute assembly • Removed Invoke-BOF in favor of RunOF • Removed Invoke-Rubeus in favor of Covenant's Rubeus • Removed Invoke-Seatbelt in favor of Covenant's Seatbelt Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.5.0

Wed, 21 Jun 2023 00:00:00 GMT

Empire 5.5.0 adds agent checkins endpoints, IronPython SMB agents, Python obfuscation, and reloadable profiles. • Adds `checkins` and `checkins/aggregate` API endpoints to expose agent checkin data as a list or aggregated view • Adds `IronPython` support for SMB Agents/Listeners • Adds `python-obfuscator` integration for Python modules • Adds LinPEAS to the Python modules library • Adds reload endpoint for Malleable Profiles, Modules, Bypasses, and Plugins • Adds staging capability to hop listener Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.4.2

Mon, 12 Jun 2023 04:05:42 GMT

Empire v5.4.2 includes Starkiller UI update and Python 3 support for multi_socks module • Adds `python_multi_socks` module compatibility with Python 3 runtime environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.2.2

Sun, 30 Apr 2023 21:55:14 GMT

v5.2.2 updates Starkiller and dependencies; v5.2.0 adds plugin system with new endpoints and kwargs. • Update Starkiller to v2.2.0 • Dependency upgrades (@Vinnybod) • Added new plugin functionality • Added plugin tasks • Added plugin task endpoints • Gave plugins kwargs to allow for more flexibility. Plugins are now receiving a database session and user object. Breaking changes: • Tasks renamed to AgentTasks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.1.2

Wed, 29 Mar 2023 05:07:16 GMT

v5.1.2 ships Starkiller v2.1.1; previous versions added D/Invoke support and module script API. • Updated bundled Starkiller web UI to v2.1.1 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.1.1

Fri, 17 Mar 2023 00:00:00 GMT

Empire 5.1.1 adds D/Invoke process injection, IronPython launcher support, and language options to spawn modules. • Adds D/Invoke option to Process Injection • Adds `language` option to `spawn` and `spawnas` modules • Adds IronPython and csharp to windows/launcher_bat Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v5.0.3

Tue, 21 Feb 2023 03:34:36 GMT

Empire v5.0.3 adds Starkiller v2.0.5, Python 3.11 support, and fixes Kerberoast; no new API endpoints or config keys introduced. • `help ` client command prints full doc string for functions like `shell` • `--literal` flag on shell commands to ignore built-in aliases like whoami or ps Breaking changes: • The old REST API has been removed; use the new v2 API instead • The old WebSocket API has been removed; use the new v2 API instead Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.0.2

Tue, 14 Feb 2023 00:00:00 GMT

Empire 5.0.2 enables task API usage with empty user identity and adds a shebang to checkout script. • Allow empty user id and username on the task API Breaking changes: • The task API now uses `module_id` instead of `module_slug` for consistent naming Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v4.10.0

Tue, 31 Jan 2023 03:27:27 GMT

Adds Debian/Ubuntu/ParrotOS support, new install flag, and Crypto Miner/PSRansom modules. • Supports installation on Debian 11, Ubuntu 22.04, and ParrotOS • Adds `-y` option to the install script for automatic confirmation • Adds C# Crypto Miner module for automated cryptocurrency mining • Adds PSRansom module for ransomware simulation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 5.0.0

Sun, 15 Jan 2023 00:00:00 GMT

Empire 5.0 adds Starkiller UI, MySQL support, v2 API, stageless agents, and `--literal` flag. • Adds Starkiller as an integrated web app • Adds full MySQL support as the new default database backend • Adds v2 API with autogenerated docs • Adds stageless options for agents • Adds clear window command to client • Adds mouse_support to client • Adds RunOF module to support COFF/BOF execution • Adds new database table for files • Adds server-side storage of stagers • Adds listener, agent, and task hooks with db session support • Adds global obfuscation config (removed from config table) • Adds authors to bypass endpoints • Adds `help ` command in client for full doc strings Breaking changes: • The old REST API is removed • The old WebSocket API is removed • The `socketport` config key is removed since socketio runs on the same port as the API • `AFTER_AGENT_STAGE2_HOOK` is replaced with `AFTER_AGENT_CHECKIN_HOOK` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v4.7.1

Tue, 02 Aug 2022 04:54:39 GMT

Empire v4.7.0 adds IronPython module support, Chisel proxy submodules, and a resource file client command • Add `resource` file command to the Empire client for loading external script files • New `IronPython` execution environment allowing PowerShell and C# scripts to run inside modules • Add `ChiselServer` plugin as a submodule for Socks proxy tunneling • Add `SocksProxyServer` plugin as a submodule for Socks proxy tunneling Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 4.7.0

Sat, 25 Jun 2022 00:00:00 GMT

Adds `resource` command, PowerShell/C# IronPython modules, ChiselServer/SocksProxyServer plugins. • Add a resource file command to the client • Add ChiselServer, SocksProxyServer plugin as a submodule Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v4.6.1

Thu, 23 Jun 2022 03:05:57 GMT

Empire v4.6.0 adds Certify module, embedded VNC, C#/BAT obfuscation, JA3 evasion, and --reset CLI flag; v4.6.1 is a bug fix. • `Certify` C# module added for active directory certificate attacks • Embedded VNC client and launcher for remote desktop via agent • New `obfuscate` option on C# payload creation to obfuscate generated code • Global obfuscation enabled for all C# modules via config/option • `--BasicParsing` flag added to `.bat` launcher for compatibility • Obfuscation support added to BAT launchers for HTTP and HTTP COM listeners • New option to enable or disable JA3 evasion technique • JA3 evasion technique now supported in Malleable HTTP profiles • Config option added to client UI to remove borders on tables Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 4.6.0

Tue, 24 May 2022 00:00:00 GMT

Empire 4.6.0 adds Certify module, embedded VNC, C# obfuscation, JA3 evasion, and BAT launcher args • `--reset` flag added to the client for resetting configuration • Added `Certify` C# module for certificate-related attacks • Added embedded VNC client and launcher capability • Added global obfuscation option to C# modules • Added obfuscation support to BAT launcher for HTTP and HTTP COM transports • Added `-BasicParsing` flag to the `.bat` launcher • Added option to enable/disable JA3 evasion in agent staging • Added JA3 evasion technique support within Malleable HTTP profiles • Updated client config option to remove borders on tables Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v4.5.3

Tue, 26 Apr 2022 02:19:10 GMT

v4.5.3 adds C# execution modules and configurable keyword obfuscation in config.yaml • `script_import` can now upload files from the client's machine to the agent session. • Adds `Keyword_Obfuscations` section to `config.yaml` to define keyword replacement lists for payload generation. • Adds support for C# execution modules within the Empire agent framework. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 4.5.0

Sun, 27 Mar 2022 00:00:00 GMT

powershell-empire 4.5.0 introduces keyword obfuscation config, C# modules, and script_import capability • Added C# execution modules for post-exploitation • script_import now supports uploading a file from the client's machine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v4.4.1

Wed, 16 Mar 2022 05:46:43 GMT

Empire v4.4.1 adds auto-copy clipboard and directory settings in yaml; includes bug fixes. • Added `auto_copy` option to listener configurations to automatically copy the staging URL to the clipboard upon listener creation • Added `download_path`, `stager_path`, and `obfuscated_module_path` keys to the main `.empire/config.yaml` file to control where generated artifacts are stored Breaking changes: • Removed `http_mapi.ps1` from the project; any custom listeners or modules referencing this script will fail to load. • Removed support for `meterpreter` and `mapi` listener types; existing configurations using these listeners must be migrated to a supported type. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire 4.4.0

Mon, 14 Feb 2022 00:00:00 GMT

Empire 4.4.0 adds directory settings to YAML config, C# process injection module, PowerShell bypass YAMls, and Black/Isort integration. • `directory` config keys in YAML for `downloads`, `stagers`, and `obfuscated_modules` paths • New C# process injection agent/listener module • New bypass configuration YAMls for PowerShell listeners • Black and Isort code formatting integration Breaking changes: • Random capitalization function removed from listener configuration (listeners no longer randomize case) • Removed meterpreter and mapi listeners (these listener types are no longer available) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v4.3.3

Tue, 25 Jan 2022 02:30:13 GMT

Adds obfuscation, file upload/download, autostart plugin, Invoke-BOF support, and agent stage2 hooks to Empire CLI • Adds obfuscation options into Empire CLI • Adds upload & download options for Empire CLI • Adds autostart plugin with options to config file • Adds C# server plugin to run on startup • Adds Invoke-BOF module • Added hook for when an agent is fully checked in (stage2) • Adds Plugin folders and extensions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire

powershell-empire v4.2.0

Tue, 07 Dec 2021 04:17:47 GMT

Empire v4.2.0 adds revershell/cmd launchers, IronPython support, SOCKS/TOR/HTTP pivots, Donut shellcode, and C# VNC server • Adds `revershell` launcher to the available payload options for agent creation • Adds `cmd` launcher to the available payload options for agent creation • Adds IronPython support allowing compilation through Empire with an embedded standard library • Adds proxy pivot capabilities (SOCKS, TOR, HTTP) directly within python-based agents • Adds a new `VNC` module backed by a C# implementation for remote desktop access • Adds extended rights management for Active Directory certificate templates • Adds Donut support for generating shellcode from .NET assemblies Breaking changes: • sRDI is removed as a supported method for shellcode delivery Full history on Cyber Toolchain: https://cybertoolchain.io/tools/powershell-empire