Powershell Empire Cmdlets Executed in Command Line
This query identifies use of PowerShell Empire's cmdlets within the command line data of the PowerShell process, indicating potential use of the post-exploitation tool.
Detection logic
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 51 ATT&CK techniques it maps to.
- Log source product
- securityeventswindowsforwardedeventswindowssecurityevents
- Log source service
- securityeventsecurityeventswindowsevent
MITRE ATT&CK mappings
3 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
Execution
- T1047Windows Management Instrumentation93 detections cover this technique
- T1053Scheduled Task/JobAlso under Persistence and Privilege Escalation.
- T1059Command and Scripting Interpreter598 detections cover this technique
- T1106Native API33 detections cover this technique
- T1127Trusted Developer Utilities Proxy ExecutionAlso under Stealth.
- T1569System Services
- T1574Hijack Execution FlowAlso under Stealth.
- T1574.001DLL111 detections cover this technique
- T1574.004Dylib Hijacking1 detection covers this technique
- T1574.007Path Interception by PATH Environment Variable10 detections cover this technique
- T1574.008Path Interception by Search Order Hijacking4 detections cover this technique
- T1574.009Path Interception by Unquoted Path3 detections cover this technique
Persistence
Privilege Escalation
- T1055Process InjectionAlso under Stealth.101 detections cover this technique
- T1068Exploitation for Privilege Escalation164 detections cover this technique
- T1134Access Token ManipulationAlso under Stealth.42 detections cover this technique
- T1484Domain or Tenant Policy ModificationAlso under Defense Impairment.
- T1548Abuse Elevation Control Mechanism
Credential Access
Discovery
- T1016System Network Configuration Discovery45 detections cover this technique
- T1046Network Service Discovery91 detections cover this technique
- T1049System Network Connections Discovery22 detections cover this technique
- T1057Process Discovery29 detections cover this technique
- T1082System Information Discovery134 detections cover this technique
- T1083File and Directory Discovery63 detections cover this technique
- T1087Account Discovery
- T1135Network Share Discovery21 detections cover this technique
- T1217Browser Information Discovery5 detections cover this technique
- T1482Domain Trust Discovery43 detections cover this technique
- T1518Software Discovery
- T1615Group Policy Discovery9 detections cover this technique
Lateral Movement
Collection
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- ef88eb96-861c-43a0-ab16-f3835a97c928
- Tagged by the source as
- CollectionCommandAndControlCredentialAccessDefenseEvasionDiscoveryExecutionExfiltrationLateralMovementPersistencePrivilegeEscalation
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Aug 29, 2026
- Version
- 1