Resolve merge conflicts:
- CHANGELOG.md: keep full 6.5.0 release notes, incorporate main's backfilled Starkiller entries
- docs/modules/module-development/README.md: keep MITRE ATT&CK Fields section from release
- empire/server/config.yaml: use Starkiller v3.4.0 from release, keep public plugin registry from main
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add dynamic depends_on options to stagers and fix module options
- Fix DependsOn key casing inconsistency: normalize stager options from
Depends_on to DependsOn and fix evaluate_dependencies to check the
correct key, making the dependency skipping logic functional
- Add DependsOn to all 17 stagers with Obfuscate/ObfuscateCommand:
Obfuscate depends on Language=powershell, ObfuscateCommand depends
on both Language=powershell and Obfuscate=True
- Add missing depends_on to 5 module YAML files (invoke_bypass,
invoke_ntsd, service_exe_stager, write_dllhijacker, ProcessInjection)
- Add Language=powershell dependency to Obfuscate in modules with
Language option (spawn, spawnas, invoke_psexec, ThreadlessInject,
ProcessInjection, bypassuac_fodhelper)
- Fix empty depends_on in bypassuac_fodhelper.yaml
- Update test_option_util.py to use consistent DependsOn key
https://claude.ai/code/session_0146JEJUaGw2wNYjsrtbgf1V
* feat: add strict and suggested_values to boolean switch options in modules
Add strict: true and suggested_values for True/False to 28 boolean
switch options across 15 module YAML files that were missing them.
https://claude.ai/code/session_0146JEJUaGw2wNYjsrtbgf1V
* fix: remove redundant description text from Obfuscate/ObfuscateCommand options
Since depends_on now handles conditional visibility, the description
notes about "For powershell only" and "Only used if Obfuscate switch
is True" are redundant and cluttering the UI.
https://claude.ai/code/session_0146JEJUaGw2wNYjsrtbgf1V
* fix: remove redundant "Switch." prefix from option descriptions
The UI already handles displaying the option type, so the "Switch."
prefix in descriptions is redundant.
https://claude.ai/code/session_0146JEJUaGw2wNYjsrtbgf1V
* style: run ruff lint, ruff format, and yamlfmt
https://claude.ai/code/session_0146JEJUaGw2wNYjsrtbgf1V
* docs: add changelog entries for dynamic options and description cleanup
https://claude.ai/code/session_0146JEJUaGw2wNYjsrtbgf1V
* fix: resolve option validation bugs and mark conditional options as required
- Fix evaluate_dependencies to handle DependsOn being None
- Fix strict validation crash when SuggestedValues is None
- Include options with unmet dependencies in output with default values
instead of skipping them, preventing KeyError in module generate()
- Remove broken revert_options logic in stager_service that caused
circular reference errors during JSON serialization
- Fix invoke_ntsd.py setting stager options without ["Value"] key
- Mark Listener and Command as required in 7 lateral movement modules
(psexec, wmi, smbexec, dcom, psremoting, inveigh_relay, executemsbuild)
so they are validated when their depends_on condition is met
- Add missing depends_on for Listener in invoke_executemsbuild and fix
Command depends_on from Payload=Empire to Payload=Manual
- Rewrite nanodump BOF module to use bof_packer for proper argument
serialization
- Update test assertions to match new dependency behavior
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: update changelog and document conditional required options
- Add changelog entries for all bug fixes, nanodump module, and
conditional required options in lateral movement modules
- Document conditional required pattern (required: true + depends_on)
in module development docs with Payload/Listener/Command example
- Update module configuration docs to mention conditionally required
options
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fixed bof test issue
* fix: standardize DependsOn key to PascalCase across listeners, plugins, and stager DTOs
Listeners and plugins used `Depends_on` (mixed case) while stagers and
option_util used `DependsOn` (PascalCase). Standardize on `DependsOn` to
match the convention of all other internal option keys (Description,
Required, SuggestedValues, etc.). Also fix trailing colon typo in
`depends_on:` dict keys in listener and stager DTOs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove unnecessary Depends_on fallback in stager template service
No stager defines `Depends_on` in its options, so the `pop` fallback
was unnecessary defensive code.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Fix MITRE ATT&CK tagging in PowerShell modules
Correct malformed technique IDs (T11082→T1082, T1555.03→T1555.003,
T11638→T1040), replace deprecated techniques (T1076→T1021.001,
T1933 removed, T1101.005→T1547.005), fix malformed tactic strings,
add missing software fields (S0521 for BloodHound/SharpHound, S0002
for Mimikatz), add missing tactics to modules that had none, and
resolve technique-to-tactic inconsistencies across 63 modules.
Validated against MITRE ATT&CK Enterprise STIX data.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Fix MITRE ATT&CK tagging in Python modules
Add missing tactics field to 80 Python modules (macOS collection,
Linux persistence/privesc, DCOS, AD discovery) that had no tactic
tags. Fix wrong software field (T1169→empty) on sudo_spawn and
piggyback modules. Resolve technique-to-tactic inconsistencies.
Tactics derived from MITRE ATT&CK Enterprise STIX technique→tactic
mappings and module directory categorization.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Fix MITRE ATT&CK tagging in C# modules
Correct malformed technique IDs (T1557.0001→T1557.001,
T1558.0003→T1558.003, T1555.03→T1555.003, T11082→T1082), fix
malformed tactic string on SharpSC, replace deprecated techniques
(T1076→T1021.001, T1933 removed), add missing software field
(S1071 for Rubeus), add missing tactics to Spawn module, and
resolve technique-to-tactic inconsistencies across 15 modules.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Fix MITRE ATT&CK tagging in BOF modules
Add missing tactics for technique-to-tactic consistency across 12
BOF modules. Ensures all listed techniques map to at least one
tactic the module declares.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Update CHANGELOG and module development docs for MITRE ATT&CK audit
Add changelog entry documenting the ATT&CK tagging audit and fixes
across all 439 modules. Update the module development guide to include
a MITRE ATT&CK Fields section with proper formatting guidance, and fix
the YAML example to use real tactic/technique IDs instead of empty
placeholders.
Ultraworked with [Sisyphus]
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Fix MITRE ATT&CK technique assignments in PowerShell modules
Remove incorrect T1482 (Domain Trust Discovery) from 19 modules that enumerate
users, groups, computers, or network shares — not domain trusts. Remove
incorrect T1615 (Group Policy Discovery) from 3 modules unrelated to GPO
enumeration. Add missing T1049 (System Network Connections Discovery) to
session enumeration modules. Fix T1514 removal in powershell_template and
correct edge-case technique assignments for sessiongopher, honeyhash, and
smbautobrute.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Fix MITRE ATT&CK technique assignments in Python modules
Replace 27 deprecated technique IDs predating ATT&CK v10 with current
equivalents: T1141→T1056.002, T1142→T1555.001, T1156→T1546.004,
T1165→T1037.005, T1166→T1548.001, T1168→T1053.003, T1208→T1558.003,
T1081→T1552.001, T1139→T1552.003, T1155→T1059.002, T1157→T1574.004.
Remove Mobile ATT&CK IDs (T1414, T1426) and invalid IDs (T1256,
T1156.001, T1081.001). Remove incorrect T1482 from 12 AD enumeration
modules. Replace T1106 (Native API) with T1059.006 (Python) on 5 DCOS
REST API modules. Remove T1514 from python_template. Fix edge cases in
SuidGuidSearch, HijackScanner, etcd_crawler, mail, and prompt modules.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Fix MITRE ATT&CK technique assignments in C# modules
Remove incorrect T1482 (Domain Trust Discovery) from Rubeus, Certify, and
5 SharpSploit enumeration modules that query users, groups, computers, or
local groups — not domain trusts. Add missing T1049 (System Network
Connections Discovery) to GetNetSession.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Fix MITRE ATT&CK technique assignments in BOF modules
Remove incorrect T1482 (Domain Trust Discovery) from 3 ADCS enumeration
modules that query certificate templates and CAs — not domain trusts.
Replace with T1069.002 (Domain Groups) which better describes their
certificate-related AD enumeration.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Update CHANGELOG for MITRE ATT&CK technique audit
Add 5 entries documenting round 2 of the ATT&CK audit: deprecated ID
replacements, T1482/T1615 over-tagging removal, T1106 DCOS correction,
and missing technique additions.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* Enrich MITRE ATT&CK technique tags across 53 modules
Corrected 10 wrong technique assignments (e.g. LaunchAgent T1055→T1543.001,
screensaver T1113→T1056.002, DownloadFile T1041→T1105), upgraded 6 parent
techniques to specific sub-techniques, added T1105 to 12 lateral movement
modules, and enriched 33 existing technique tags across PowerShell, Python,
and C# modules. Net coverage: 181→190 unique techniques (+10 new IDs).
Fixed 2 pre-existing duplicate technique entries in RevertToSelf and NetRipper.
Ultraworked with [Sisyphus]
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
---------
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* GitBook: No commit message
* GitBook: No commit message
* Update docs/.gitbook/assets/Continuous.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/completed.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/continious.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/pulled.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/queued.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/error.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* fixed markdown files
---------
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* GitBook: No commit message
* GitBook: No commit message
* Update docs/.gitbook/assets/Continuous.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/completed.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/continious.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/pulled.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/queued.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* Update docs/.gitbook/assets/error.svg
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* fixed markdown files
---------
Co-authored-by: Vincent Rose <vrose04@gmail.com>
* bof fixes
* updated other bofs with custom generate
* formatting
* added runcoff module from trustedsec
* updated bof execution to use coffloader
* updated docs
* updated empirecompiler install to mirror starkiller process
* updated autoupdate and tests for empire compiler
* fixed issue where sync-empire-compiler would not work with dicts
* updated docs and dockerfile
* fixed compiler to use ssh or https and revised test
* reverted missing docker docs
* changed from ssh to https as default clone option in config
* removed sharpire install test
* fixed plugin test that was failing during docker tests
* fixed docker test showing 5 vs 6
* removed unused tasks 111 and 113
* moved task 44 to 116
* reorganized tasks into 3 supported languages
* added invoke-script for loading script in memory replacement
* fixed option validation to take into account files being a dependent option
* updated option validation and added tests
* added python invoke script and updated validation
* revised validate options again and added docs
* added DependsOn as validation default to fix validation tests
* Fixed directory for doc gifs in modules
* fixed python invoke-script gif
* fixed changelog and reduced gif sizes
* removed unused proxy classes
* removed agent.functions
* removed default values for python invoke_script
* fixed unused normalization for is_option_required
* Update empire/server/utils/option_util.py
Co-authored-by: Vincent Rose <vrose04@gmail.com>
---------
Co-authored-by: Vincent Rose <vrose04@gmail.com>
Vincent Rose