PowerShell Empire Persistence and Recon Modules

PowerShell empire is a post-exploitation agent. Empire implements the ability to run PowerShell agents without needing powershell.exe, modules ranging from keyloggers to Mimikatz, and adaptable communications to evade network detection. This is all bundled into a framework which is publicly available on GitHub. As such, this tool’s ease of use and availability makes it likely to be used in exploitation involving PowerShell.

Exploitation

Stages

1. The attacker exploits a Windows server via an unknown mechanism.
2. The attacker utilizes the PowerShell Empire framework to act upon their objectives.
3. The server returns the information/response the attacker wants.

Prerequisites

The attacker will need some level of access to the server either via an exploit or stolen credentials.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Detection of this threat is provided via the Alert Logic ActiveWatch for Log Manager™ service. Log messages are produced by the vulnerable system when an exploit of this type is leveraged. An incident will be generated in the Alert Logic console if these log messages are observed.

Recommendations for Mitigation

The attacker must have exploited some other entry vector to gain access to the local victim host. Ensure that all software on internet-facing hosts is up-to-date.