liveBook · Manning

Empire

As explained in Cyber Threat Hunting

An open-source post-exploitation framework for managing compromised hosts through adversary-controlled agents and code.

Empire is an open-source post-exploitation framework that manages compromised hosts through adversary-controlled agents and code. Its PowerShell stager downloads further code and enables access to a compromised endpoint. section 7.1.4

Detection depends on investigating suspicious connections rather than accepting benign explanations. Encoded PowerShell connected to 162.125 addresses over HTTPS, used a bearer token, and contacted Dropbox infrastructure; osquery exposed the activity after beaconing analytics identified the endpoint. section 7.1.4

Listing 7.16 Processes connecting to IP addresses containing 162.125
pid: 9444                                                 #1
name: powershell.exe                                      #2
cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\
 powershell.exe" -noP -sta -w 1 -enc
 SQBmACgAJABQAFMAVgBlAHIAcwBpAG8AbgB
 UAGEAYgBsAGUALgBQAFMAVgB
    ...
    VgArACQASwApACkAfABJAEUAWAA=                          #3
local_address: 10.0.0.4
local_port: 52326
remote_address: 162.125.2.14
remote_port: 443

Inspect the process, encoded PowerShell command line, and network connection associated with a suspected Empire stager. section 7.1.4

How Cyber Threat Hunting covers it

How deep it goes
Defines Empire and traces a stager through encoded PowerShell, headers, bearer authentication, DNS, and endpoint queries.
Examples
Uses encoded PowerShell processes, 162.125 network connections, Dropbox comparisons, and osquery process and socket queries.
What it assumes
Assumes familiarity with statistical analytics and osquery while defining bearer tokens and identifying Empire from observed behavior.
What you can do after
Diagnose suspected Empire activity by correlating process command lines, encoded PowerShell, network sockets, headers, and endpoint context.
How it connects
Connects Empire with post-exploitation, PowerShell, stagers, osquery, beaconing, Dropbox, bearer tokens, and DNS.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.