Empire
BSD-3-Clause🔥 Offensive Ops · Python
Empire is a post-exploitation and adversary emulation framework maintained by BC-Security. It provides PowerShell, Python, and C# agents (called stagers) with cryptologically-secure communications and a flexible architecture. Empire includes hundreds of post-exploitation modules for privilege escalation, credential harvesting, lateral movement, persistence, and situational awareness across Windows, Linux, and macOS. The framework features a RESTful API, collaborative multi-operator support via Starkiller GUI, and malleable C2 profiles for traffic blending. It maps operations to MITRE ATT&CK for adversary emulation reporting.
Installation
$ git clone https://github.com/BC-SECURITY/Empire.git && cd Empire && ./setup/install.shUse Cases
- Red team post-exploitation and lateral movement
- Adversary emulation mapped to MITRE ATT&CK
- Multi-platform agent deployment and management
- Credential harvesting and privilege escalation
Tags
Details
- Category
- 🔥 Offensive Ops
- Language
- Python
- Repository
- BC-SECURITY/Empire
- License
- BSD-3-Clause
- Platforms
- 🐧linux🍎macos🪟windows
Links
Community Reviews
Alternatives & Comparisons
Covenant
C#.NET C2 framework. Collaborative, web-based interface for red team operations and implant management.
Compare Empire vs CovenantSliver
GoOpen-source C2 framework by BishopFox. mTLS, HTTP(S), DNS, WireGuard implants with multi-operator support.
Compare Empire vs SliverMythic
GoCollaborative, multi-platform C2 framework. Docker-based with web UI, multiple agent types, and plugin architecture.
Compare Empire vs MythicMore in Offensive Ops
Mythic
GoCollaborative, multi-platform C2 framework. Docker-based with web UI, multiple agent types, and plugin architecture.
Havoc
C/C++Modern C2 framework. Qt-based GUI, BOF support, custom agents, and a Cobalt Strike-inspired workflow.
Rubeus
C#C# toolset for raw Kerberos interaction and abuse. AS-REP roasting, Kerberoasting, ticket manipulation, delegation attacks.
Certipy
PythonActive Directory Certificate Services (AD CS) abuse tool. Find and exploit certificate template misconfigurations.
Coercer
PythonAutomatically find and exploit Windows authentication coercion vulnerabilities. PetitPotam, PrinterBug, and more.
SharpHound
C#Official BloodHound data collector. Enumerates Active Directory objects, sessions, ACLs, and trusts for graph analysis.