Conducting Robust Learning for Empire Command and Control Detection
Summary: Palo Alto Networks Unit 42 researchers built a machine learning system to detect command and control traffic from PowerShell Empire, a post-exploitation framework first shown at BSides Las Vegas in 2015 whose original project stopped development in 2019 but which persists through at least one maintained fork. The system uses a Convolutional Neural Network trained on both collected Empire C2 traffic and traffic generated by an internally developed fuzzer that mutates Malleable C2 profiles to simulate adversarial evasion attempts.
What you should know: Empire's Malleable C2 profiles let an attacker regenerate completely different HTTP traffic from the same campaign, so a signature built on one observed URI such as /api/v1/users will miss the next variant entirely - and the framework has been associated with high-profile ransomware cases.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026