Skip to main content

Workflow

This section outlines the key steps and foundational workflow for CTE operators to effectively utilize PowerShell-Empire.

  1. Start the PowerShell-Empire Server

    • Before you can use PowerShell-Empire to manage agents or listeners, you must start the server component

  2. Start a PowerShell-Empire Client

    • Once you've started the Empire server, you can use the PowerShell-Empire client to connect to it

    • You can connect to the server running on the localhost, or connect to a remote PowerShell-Empire server

  3. Set Up a Listener

    • Setup a listener whose communications will blend in with the environment

  4. Generate a Stager

    • The stager has to be paired with a configured listener so that it knows how and where to beacon back to

  5. Deploy the Stager

    • The stager is the actual payload that needs to be executed on a victim, it is up to the CTE operator as to how the stager gets to victim

  6. Interact with Agents

    • Once an agent checks in due to stager execution, you can interact with it by issuing commands and receiving results

  7. Run Modules on Agents

    • Use modules to perform various tasks on compromised systems to further the attack chain

  8. Repeat steps 5-7 for additional compromised hosts