You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+77-1Lines changed: 77 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,13 +14,87 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
14
14
15
15
## [Unreleased]
16
16
17
+
## [6.5.0] - 2026-03-08
18
+
- Updated Starkiller to v3.4.0
19
+
17
20
### Added
18
21
22
+
- Log Empire version and git commit SHA at startup for easier production diagnostics; commit SHA is baked into the Docker image at build time via `--build-arg`
23
+
- Added C stager for lightweight stage0 shellcode injection via Fibers
24
+
- Added `shellcode_compiler` utility for compiling position-independent C stagers into raw x64 shellcode for BOF process injection
25
+
- Added `clipboard_window_inject_list` BOF module for enumerating processes with clipboard window class
26
+
- Added PIC shellcode C template and linker script for MinGW-based shellcode compilation
27
+
- Added unit tests for `shellcode_compiler` and rewrote `test_bof_packer` to cover the new `Packer` class API
19
28
- Added a runtime `Background` option to C# modules, allowing operators to override background/foreground execution at task time
29
+
- Added C# PatchETW module for in-process ETW patching via ntdll!EtwEventWrite
30
+
- Added C# PatchlessAMSI module for patchless AMSI bypass using hardware breakpoints and vectored exception handling
31
+
- Added PowerShell Invoke-VSSExtract module for NTDS.dit and SYSTEM hive extraction via Volume Shadow Copy
32
+
- Added PowerShell Invoke-RDPHijack module for RDP session hijacking via tscon.exe
33
+
- Added Python linux_keyring module for credential extraction from the Linux kernel keyring subsystem
34
+
- Added Python aws_imds module for AWS IAM role credential theft via EC2 Instance Metadata Service
35
+
- Added BOF `spawn` module for EarlyBird process hollowing with suspended process creation, shellcode injection, and APC thread hijacking
36
+
37
+
### Changed
38
+
39
+
- Added Python 3.14 support (supports 3.13 and 3.14); Dockerfile now uses `python:3.14.3-trixie`
40
+
- Replace `os.path` with `pathlib` in core code and enforce `PTH` lint rule for all core files
41
+
- Switch `stager_generation_service` from deprecated `installPath` (str) to `install_path` (Path)
42
+
- Optimized test suite for faster CI and local runs
43
+
- Modernize Python patterns in core code: use `setdefault()`, truthiness checks, `click.style()` for terminal colors, and remove redundant operations
44
+
- Reduced test fixture boilerplate with a shared `make_agent()` factory and deduplicated `plugin_task` fixture across test files
45
+
- Removed `autouse` from test fixtures that don't need it, making test dependencies explicit
46
+
- Added unit tests for encryption, packet handling, helpers, malleable transformations, and listener utilities
47
+
- Migrate remaining `installPath` usages to `install_path` (Path) in core services
48
+
- Use `Path.read_text(encoding="utf-8")` instead of `read_bytes().decode()` in stager generation
49
+
- Replace `os.system()` calls with `subprocess.run()` in stager JAR generation
50
+
- Upgraded all Python dependencies to latest versions (Feb 2026)
51
+
- Replace deprecated `handle_error_message` with raised `ModuleValidationException` in all modules (#716)
52
+
- Convert 51 modules to use `@auto_get_source` and `@auto_finalize` decorators, eliminating boilerplate (#716)
53
+
- Replace unmaintained `terminaltables` dependency with `prettytable` (#809)
54
+
- Refactored `bof_packer` from standalone functions to a `Packer` class with granular packing methods (`addbytes`, `addstr`, `addWstr`, `addbool`, `adduint32`, `addint`, `addshort`)
55
+
- Rewrote `clipboard_window_inject` BOF module to use PIC shellcode instead of PowerShell launcher-based shellcode generation
56
+
- Simplified `clipboard_window_inject` module options by removing unnecessary launcher parameters and corrected BOF format string
57
+
- Bumped Empire Compiler from v0.4.3 to v0.4.4
58
+
59
+
### Removed
60
+
61
+
- Removed `secinject` BOF module and its pre-compiled binary
20
62
21
63
### Fixed
22
64
65
+
- Fixed SQLAlchemy connection pool exhaustion caused by async hooks receiving the caller's committed session. `run_hooks` now wraps async hooks in `_run_async_hook`, which opens a fresh `SessionLocal` session for each hook and closes it cleanly after the hook returns. ORM objects are re-attached via `session.merge()` so lazy-loaded relationships resolve correctly.
66
+
- Fixed SQLAlchemy connection pool exhaustion during agent check-ins by releasing the DB session before expensive file I/O, encryption, and packet building in `handle_agent_request()`
67
+
- Fixed custom-generate BOF modules (`clipboard_window_inject`, `spawn`, `clipboard_window_inject_list`) returning .NET-only `file|,json` format for Go agents, causing BOF execution to fail on the Go agent's COFF loader
68
+
- Added `format_bof_output()` to `ModuleService` to centralize BOF output formatting for Go and .NET agents
69
+
- Pass `agent_language` to custom-generate modules so they can produce agent-appropriate output
70
+
- Fixed malleable HTTP listener stagers failing after server restart due to random URI regeneration in `Stager._defaults()`
71
+
- Fix null-safety bug in `_process_agent_packet` when `save_module_file` returns None on skywalker exploit detection
23
72
- Fixed stop-job handlers in PowerShell and Python agents crashing when the target job doesn't exist
73
+
- Fixed the `docs/quickstart/installation/README.md` file to specify a previously missing reference to Ubuntu
74
+
- Fixed 9 malformed MITRE ATT&CK technique IDs across PowerShell, Python, and C# modules
75
+
- Fixed 2 malformed tactic fields that used space-separated strings instead of YAML lists
76
+
- Replaced 7 deprecated or revoked ATT&CK techniques with current equivalents
77
+
- Added missing `software` field for known ATT&CK tools (Rubeus, BloodHound, Mimikatz)
78
+
- Added missing `tactics` field to 82 Python modules that had none
79
+
- Fixed 74 technique-to-tactic inconsistencies across all module languages
80
+
- Replaced 27 additional deprecated technique IDs predating ATT&CK v10 with current equivalents across Python and template modules
81
+
- Removed incorrect T1482 (Domain Trust Discovery) from 32 modules that perform user, group, or computer enumeration
82
+
- Removed incorrect T1615 (Group Policy Discovery) from 24 modules unrelated to GPO enumeration
83
+
- Replaced T1106 (Native API) with T1059.006 (Python) on 5 DCOS REST API modules
84
+
- Added missing `techniques` field to 3 session enumeration modules
85
+
- Corrected 3 macOS LaunchAgent persistence modules from T1055 (Process Injection) to T1543.001 (Launch Agent)
86
+
- Corrected macOS screensaver credential prompt module from T1113 (Screen Capture) to T1056.002 (GUI Input Capture)
87
+
- Corrected Invoke-DownloadFile from T1041 (Exfiltration Over C2) to T1105 (Ingress Tool Transfer)
88
+
- Upgraded 3 keylogger modules from parent T1056 to specific T1056.001 (Keylogging) sub-technique
89
+
- Upgraded macOS email search module from T1114 to T1114.001 (Local Email Collection) sub-technique
90
+
- Upgraded macOS LoginHook persistence from T1037 to T1037.002 (Login Hook) sub-technique
91
+
- Added T1105 (Ingress Tool Transfer) to 12 lateral movement modules that deploy stagers to remote hosts
92
+
- Added 10 new ATT&CK technique IDs across 51 modules to improve coverage from 181 to 190 unique techniques
93
+
- Added T1005 (Data from Local System) to 8 macOS and Linux credential and collection modules
94
+
- Added T1550.002 (Pass the Hash) to PsExec, SMBExec, and WMI lateral movement modules
95
+
- Added T1562.001 (Impair Defenses) to AMSI bypass, ETW patching, and Outlook security modules
96
+
- Fixed duplicate technique entries in RevertToSelf and NetRipper modules
97
+
- Fixed PSRansom module `name` field incorrectly set to `Invoke-Script` instead of `PSRansom`
24
98
25
99
## [6.4.1] - 2026-02-15
26
100
- Fixed the `docs/quickstart/installation/README.md` file to specify a previously missing reference to Ubuntu
@@ -1256,7 +1330,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
Copy file name to clipboardExpand all lines: docs/modules/module-development/README.md
+15-2Lines changed: 15 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,9 +14,11 @@ authors:
14
14
- name: John Doe
15
15
handle: '@johndoe'
16
16
description: A sample module demonstrating Empire module structure.
17
-
tactics: []
17
+
software: ''
18
+
tactics:
19
+
- TA0002
18
20
techniques:
19
-
- T1234
21
+
- T1059
20
22
background: true
21
23
output_extension: ps1
22
24
needs_admin: false
@@ -32,6 +34,17 @@ options:
32
34
strict: true
33
35
```
34
36
37
+
## MITRE ATT&CK Fields
38
+
39
+
Every module should include proper MITRE ATT&CK metadata. The fields are:
40
+
41
+
- **`tactics`**: A list of ATT&CK tactic IDs (e.g., `TA0001` through `TA0043`). Every module should have at least one tactic — do not leave this as an empty list.
42
+
- **`techniques`**: A list of ATT&CK technique or sub-technique IDs. Use the format `T####` for techniques (e.g., `T1059`) or `T####.###` for sub-techniques (e.g., `T1059.001`).
43
+
- **`software`**: If the module wraps a known ATT&CK software entry, set this to its ID (e.g., `S0002` for Mimikatz, `S1071` for Rubeus). Leave as `''` if the tool is not cataloged in ATT&CK.
44
+
45
+
Refer to the [MITRE ATT&CK Enterprise Matrix](https://attack.mitre.org/matrices/enterprise/) for valid tactic, technique, and software IDs.
46
+
47
+
35
48
## Special Options
36
49
37
50
Empire reserves certain option names that receive special handling during module execution. These are filtered out of the parameters passed to the module's script and instead control how the task is dispatched or processed.
0 commit comments