ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0363tool

Empire

a.k.a. EmPyre, PowerShell Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.

Platforms: Linux, macOS, Windows

MITRE ATT&CK ↗

Linked entities · 24

usesT1125Video Capture usesT1021.003Distributed Component Object Model usesT1557.001Name Resolution Poisoning and SMB…usesT1016System Network Configuration Disc…usesT1059.001PowerShell usesT1482Domain Trust Discovery usesT1056.001Keylogging usesT1027.010Command Obfuscation usesT1136.001Local Account usesT1113Screen Capture usesT1046Network Service Discovery usesT1552.001Credentials In Files usesT1560Archive Collected Data usesT1484.001Group Policy Modification usesT1041Exfiltration Over C2 Channel usesT1082System Information Discovery usesT1115Clipboard Data usesT1068Exploitation for Privilege Escala…usesT1020Automated Exfiltration usesT1546.008Accessibility Features usesT1119Automated Collection usesT1555.001Keychain usesT1615Group Policy Discovery usesT1087.002Domain Account