Hey there.
I'm Rishalin Pillay,
and welcome to this Red Team tools course on Persistence with Empire.
A lot of APT groups and attackers in general need to establish persistence.
Persistence gives them the ability to maintain a
foothold on the targeted machine.
In this course, we will focus on persistence,
leveraging Empire,
and we will look at various persistence techniques
that can be performed using Empire.
You may have heard about PowerShell Empire,
the post‑exploitation framework based purely on PowerShell.
It enabled the capability for PowerShell agents to run
without the need of running PowerShell.exe.
It also provided a wide range of rapid deployable modules,
which ranged from keyloggers, the famous Mimikatz suite of capabilities,
evasion techniques, and a lot more.
PowerShell has been around for many years.
It was installed by default on Windows 7 and has since become
the Holy Grail for Windows administrators.
It is an extremely viable platform for administrators and for attackers.
We can spend hours talking about the capabilities of PowerShell,
but this is not the aim of the course.
The key takeaway is that PowerShell, being available since Windows 7,
has capabilities that are desirable to attackers due to
the powerful capabilities it has.
In this slide and the previous one, you may have noticed two different logos.
The first one belongs to the original PowerShell Empire.
This was created by various people in the offensive security community.
It encompassed several other projects for its underlying functionality,
and the people who contributed are listed on the Empire project's GitHub page.
The aim of the project was to demonstrate the
post‑exploitation capabilities of PowerShell and bring
awareness to PowerShell attacks that are used.
Development of PowerShell Empire stopped around 2019 when developers
felt that the security optics has been improved around PowerShell
attacks by Microsoft and the EDR industry.
The second logo belongs to the newer release called Empire 3.
This is maintained by BC SECURITY.
There are some significant improvements,
such as the support for Python 3 as opposed to version 2.7,
which was used in PS Empire.
New PowerShell modules have been incorporated,
which focus on Kerberos services ticket attacks,
SMB, red hijacking, and a lot more.
They have also included some evasion techniques to bypass
Microsoft's antimalware scan interface.
In this course, we will be using Empire 3.
A big shout out to all of the contributors who helped to
develop and maintain these great tools.
Another tool that we will be covering within this course is called Starkiller.
This has been created by BC‑SECURITY, and,
in essence, it provides a graphical interface for the Empire Server.
Within Starkiller,
you are able to perform pretty much every single task that's
available within the command line version of Empire.