When we consider the kill chain, Empire resides just
after the post exploitation phase.
It provides a wide range of modules that support privilege escalation,
lateral movement, defense evasion,
and it gives you the ability to upload and download files.
Empire hosts a wide range of modules that can be used
at various stages of the kill chain.
Considering the MITRE attack tactics, Empire plays across various tactics.
In this course, we're going to look at the persistence tactics.
The first one that we will consider is the boot or logon autostart
execution points. In the demonstration, we'll show how we can
leverage Empire to implant into a registry key so that we can have
persistence when a machine is rebooted.
We'll also consider creating a local account,
and in this demonstration, we will look at how we can leverage the dead user
capability to establish persistence when a specific user we define no longer
exists. Creating a scheduled task allows us to go ahead and set up a
repetitive task that can run at various intervals to ensure that a
persistence foothold is established.
We'll then look at how we can establish an event triggered execution,
and this is leveraging WMI. In all the demos I am using Kali Linux version
2020.3, and of course, I have performed the updates using the app‑get
update and app‑get upgrade commands to ensure that my repositories are
updated and I am running the latest updates.