5. Agent Management
Sleep and Jitter
Controlling beacon frequency is critical for evasion. A fast, regular beacon creates a predictable pattern that automated detections identify quickly.
# Syntax: sleep <delay_seconds> <jitter_ratio>
# Jitter is a ratio from 0.0 to 1.0 - adds randomness to the delay interval
# Default (5s, no jitter) - noisy, lab use only
(Empire: <AGENT_NAME>) > sleep 5 0
# Low and slow - 60s base with 20% jitter (beacons every 48–72s)
(Empire: <AGENT_NAME>) > sleep 60 0.2
# Blend into long-poll traffic - 300s base with 30% jitter
(Empire: <AGENT_NAME>) > sleep 300 0.3
For operations against monitored networks, use at minimum sleep 60 0.2. APT-style ops typically use sleep 3600 0.5 or longer. The tradeoff is responsiveness - a 1-hour sleep means you wait up to an hour for task results.
Working Hours
Restrict the agent to only beacon during specified hours. Useful for blending into business-hours traffic patterns and avoiding after-hours anomaly detection.
# Agent will only beacon between 0800 and 1700
(Empire: <AGENT_NAME>) > workinghours 08:00-17:00
Working hours are evaluated on the target system's local time, not the operator's. Account for time zone differences when setting this on remote targets.
Kill Date
Set a date after which the agent will automatically terminate and stop beaconing. Useful for ensuring agents don't persist beyond the authorized operation window.
# Agent self-terminates after this date
(Empire: <AGENT_NAME>) > killdate 12/31/2026
Kill date is a safety mechanism - set it at the start of every operation to prevent orphaned agents from continuing to beacon after the op ends.
Renaming Agents
Empire auto-generates agent names. Rename them to something meaningful for multi-agent operations.
(Empire: agents) > rename <AUTO_NAME> <NEW_NAME>
# Example
(Empire: agents) > rename XKDF3A2B WS01-ADMIN
Use a naming convention that identifies the host and privilege level, e.g. WS01-USER, DC01-ADMIN.
Clearing and Killing Agents
# Clear all pending tasks for an agent (without killing it)
(Empire: agents) > clear <AGENT_NAME>
# Kill a specific agent (terminates the agent process on the target)
(Empire: agents) > kill <AGENT_NAME>
# Kill all stale (inactive/red) agents
(Empire: agents) > kill stale
# Kill all agents
(Empire: agents) > kill all
kill all terminates every active agent. Only use during full op shutdown. There is no undo.
Switching Listeners
If a listener goes down or you need to route an agent through a different C2 channel, update the agent's comms without losing the session.
(Empire: <AGENT_NAME>) > update_comms <NEW_LISTENER_NAME>
Agent Management Quick Reference
| Task | Command |
|---|---|
| Set beacon rate | sleep <seconds> <jitter> |
| Restrict to business hours | workinghours 08:00-17:00 |
| Set self-destruct date | killdate MM/DD/YYYY |
| Rename agent | rename <old> <new> (from agents context) |
| Clear pending tasks | clear <agent_name> (from agents context) |
| Kill agent | kill <agent_name> (from agents context) |
| Kill all stale agents | kill stale (from agents context) |
| Switch listener | update_comms <listener_name> |
| View agent properties | info |