Empire 6.0 is finally here with tons of new updates and features. The team has been working on this for about a year now and we are really excited to show off all the changes. We have added new agents, revamped our compilers and added an all new marketplace for plugins. [...]
Empire 3.4.0 is our next major release and is packed with one of the most advanced features to-date, Malleable C2. The Malleable C2 Listener gives control to operators to customize their beacons to match specific threats. It does this through profiles, which are simple scripts that instruct the listener how ...
While giving our talk at the DEF CON Red Team Village a couple of weeks ago, I previewed a PowerShell ScriptBlock logging obfuscation technique. I have been working on it (and a few other techniques) for a while and decided to write a short blog about it. But as I ...
This entry will focus on the obfuscation of the PowerShell Script in the ScriptBlock log and Transcription log. First, there will be a little more discussion on a module log bypass technique because we can also use it to create some obfuscation!
You may remember the good ole days where you can connect to pretty much any mail server (like Gmail) with telnet and spoof emails to your friends from whoever you want. Back then, I never realized that you could actually send attachments directly through the telnet connection. It’s not super ...
Last month we taught our DEF CON 27 workshop, Introduction to Sandbox Evasion and AMSI Bypasses, as a webinar. It went really well, but the primary focus of the course was on delivering a primary agent to the target and getting it to run. We discussed how to obfuscate payloads ...
Going back to our Offensive Security definition, red teams and pentesters are attempting to validate that an organization’s systems.
We experienced an unexpected callback to our C2 server while sending a malicious file to an Outlook account.
BC Security found that the August 12/13 definitions update for Windows does not flag Empire or identify Mimikatz.
