WEBVTT

00:00:01.840 --> 00:00:04.940
When we consider the kill chain, Empire resides just

00:00:04.940 --> 00:00:06.870
after the post exploitation phase.

00:00:07.440 --> 00:00:11.400
It provides a wide range of modules that support privilege escalation,

00:00:11.520 --> 00:00:13.810
lateral movement, defense evasion,

00:00:14.440 --> 00:00:17.260
and it gives you the ability to upload and download files.

00:00:17.940 --> 00:00:21.160
Empire hosts a wide range of modules that can be used

00:00:21.160 --> 00:00:23.070
at various stages of the kill chain.

00:00:23.640 --> 00:00:29.150
Considering the MITRE attack tactics, Empire plays across various tactics.

00:00:29.330 --> 00:00:32.390
In this course, we're going to look at the persistence tactics.

00:00:32.840 --> 00:00:36.540
The first one that we will consider is the boot or logon autostart

00:00:36.540 --> 00:00:40.120
execution points. In the demonstration, we'll show how we can

00:00:40.120 --> 00:00:43.990
leverage Empire to implant into a registry key so that we can have

00:00:43.990 --> 00:00:46.250
persistence when a machine is rebooted.

00:00:47.640 --> 00:00:49.880
We'll also consider creating a local account,

00:00:49.990 --> 00:00:53.390
and in this demonstration, we will look at how we can leverage the dead user

00:00:53.390 --> 00:00:58.590
capability to establish persistence when a specific user we define no longer

00:00:58.590 --> 00:01:03.820
exists. Creating a scheduled task allows us to go ahead and set up a

00:01:03.830 --> 00:01:07.630
repetitive task that can run at various intervals to ensure that a

00:01:07.630 --> 00:01:09.950
persistence foothold is established.

00:01:10.540 --> 00:01:13.920
We'll then look at how we can establish an event triggered execution,

00:01:14.280 --> 00:01:19.230
and this is leveraging WMI. In all the demos I am using Kali Linux version

00:01:19.230 --> 00:01:23.720
2020.3, and of course, I have performed the updates using the app‑get

00:01:23.720 --> 00:01:27.650
update and app‑get upgrade commands to ensure that my repositories are

00:01:27.650 --> 00:01:29.760
updated and I am running the latest updates.