WEBVTT

00:00:05.740 --> 00:00:09.870
Hey there. I'm Rishalin Pillay, and welcome to this Red Team tools course.

00:00:10.340 --> 00:00:14.300
You may have heard about APT groups such as APT19 who

00:00:14.300 --> 00:00:16.300
has targeted a variety of industries.

00:00:16.360 --> 00:00:17.870
What about FIN10,

00:00:17.880 --> 00:00:21.190
who is a financially motivated group who uses

00:00:21.190 --> 00:00:23.870
stolen data to extort organizations?

00:00:24.740 --> 00:00:26.870
Another group is the CopyKittens.

00:00:27.310 --> 00:00:29.710
They were responsible for Operation Wilted Tulip.

00:00:30.140 --> 00:00:32.400
What is so significant about these groups?

00:00:32.840 --> 00:00:37.210
Well, one of the tools that they actively use is called Empire,

00:00:37.350 --> 00:00:39.650
commonly referred to as PowerShell Empire.

00:00:40.440 --> 00:00:44.410
Once these APT groups establish C2 channels into an environment,

00:00:44.860 --> 00:00:47.070
the next step is for them to maintain their foothold.

00:00:47.640 --> 00:00:49.860
This is where persistence comes into play.

00:00:50.440 --> 00:00:51.220
In this course,

00:00:51.300 --> 00:00:54.410
I will show you how to establish persistence using

00:00:54.410 --> 00:00:58.970
Empire. Empire leverages PowerShell, which is predominantly used today.

00:00:59.640 --> 00:01:01.950
PowerShell is an extremely powerful tool,

00:01:02.340 --> 00:01:07.210
which is used by both administrators and attackers. Empire

00:01:07.210 --> 00:01:10.610
has the ability to manage multiple agents and perform

00:01:10.610 --> 00:01:13.010
multiple post‑exploitation capabilities.

00:01:13.260 --> 00:01:18.590
It is robust with over 300 modules that can be used. If you are looking

00:01:18.590 --> 00:01:22.130
for a tool that can be used for persistence, please join me in this

00:01:22.130 --> 00:01:25.840
course where I will show you how to perform persistence techniques that

00:01:25.840 --> 00:01:28.570
are used today by real‑world attackers.