Empire has a lot of inbuilt modules that allow us to use persistence on a system while performing a red team activity. These modules are divided into four main areas:
- PowerBreach: This is a series of in-memory PowerShell backdoors that provide triggers for various options
- userland: These are backdoors that execute on reboot without needing admin rights
- elevated: These are backdoors that execute on reboot with admin rights
- debugger triggers: These are backdoors that execute on a particular trigger (an example of this is sticky keys)
In this section, we will cover some of the modules for Linux, Windows, and macOS systems.
For Windows:
Assuming we have an agent connected on our empire from a Windows Machine:
To view a list of available persistence modules, we interact with agents using the interact <agent name> command.
Next, to view the available...