PowerShell Empire

PowerShell Empire is a post-exploitation agent framework that merges the previous PowerShell Empire and Python EmPyre projects. It includes a pure-PowerShell2.0 Windows agent and a pure Python Linux/OS X agent, offering cryptologically-secure communications and a flexible architecture. The framework enables running PowerShell agents without powershell.exe, rapid deployment of post-exploitation modules, and adaptable communications to evade network detection, all within a usability-focused design.

Use cases include post-exploitation operations such as key logging, credential dumping with Mimikatz, and other advanced persistence and lateral movement techniques on Windows, Linux, and OS X systems. It supports evasion of network detection through flexible communication profiles.

The tool is installed size 49.73 MB and requires numerous Python3 dependencies along with default-mysql-server, git, pyinstaller, starkiller, and sudo.

Empire operates with a pure-PowerShell2.0 agent for Windows and pure Python agent for Linux/OS X, implementing cryptologically-secure communications. It runs PowerShell agents without powershell.exe, deploys modules like keyloggers and Mimikatz, and uses adaptable communications to evade detection. The server is launched via empire.py server after setup, managing agent communications through a flexible C2 architecture.