0

My understand of Empire is a framework that allows hackers to create listeners, and run code over the internet with the help of power shell through the use of DLL injections, Thread Injections, and loading code into memory which can create an agent over port 8080.

To Defend against this I would:

  • Update Powershell to v5 and ConstrainedLanguageMode to prevent .NET being loaded.
  • Enable memory protections via EMET (ASLR, SEHOP memory protections)
  • Enable a whitelisting on the system.
  • Use Get-InjectedThreads module to detect threads.
  • DLL Audit and check for injected DLLs.

Is there anythings more I can/should do? Am I missing anything?

Here is an example of how the process works. enter image description here

Empire can be found here: https://github.com/EmpireProject/Empire

3

That seems to be a pretty-good start. ConstrainedLanguageMode is a huge deterrent. Maybe add Microsoft ESAE as well as JitJea administration. Force the use of SMBv3. Eliminate LM/NTLM. UAC Max. DeviceGuard. Not very user-friendly, but you asked.

Perhaps also:

1

Based on the description, Empire says that it is a "post-exploitation framework". What post-exploitation means here is that the attacker must use another exploit to gain admin access to your machine, as Empire itself contains no capability to inject itself into a machine that wasn't already compromised. By the time any of Empire's code runs, your attacker had already pwned your machine, i.e. they already have an admin privilege on the machine.

There's nothing really that you can or need to do in particular to "protect" a machine when you've already lost the battle, you only can do detection and damage control. With admin privilege, Empire or the attacker can simply disable any security you put. The only thing you can really do is clean up the machine or take it down, patch the exploit that were used by the attacker, and deploy a new machine.

Update Powershell

This is ineffective. Empire is written in Powershell, yes, but it can carry its own Powershell interpreter, so it doesn't matter what whether or not you have Powershell installed on the machine or what version you have installed, or what configuration you have on them.

My advice is to keep your machines patched to the latest update, ensure you have sensible firewall configuration, make sure you download and install software from trusted source, make sure you have up to date backup of important data, audit permissions of any software you run, review your logs, enforce separation/segmentation between critical services, make you're running up to date antivirus with up to date definition, and don't install software and services you don't really need. In other words, all standard security good practice and hygiene.

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .