Home/Powershell Empire 101/Agents in PowerShell Empire
1 min read

Agents in PowerShell Empire

An agent in PowerShell Empire is the persistent post-exploitation implant that runs on the compromised system after a successful stager has executed. It acts as the primary communication interface bet

Agents in PowerShell Empire

Role in the Attack Lifecycle

Phase Role of Agent
Post-Exploitation Executes commands, scripts, modules
Persistence Can survive reboots and re-establish communication
Lateral Movement Facilitates spreading across a network
Exfiltration Transfers sensitive data back to the C2

Lifecycle Overview

  1. Stager is executed on the target system.
  2. The stager downloads and executes the full agent.
  3. The agent establishes a secure, encrypted channel back to the Empire listener.
  4. The attacker can now:
    • Run commands
    • Upload/download files
    • Move laterally
    • Persist or clean up