Hands-On Red Team Tactics

Phase 4 – Acquiring Agent

When the stager is executed on the target system, the Agent will connect back to the Empire Listener. We can view the active agents using the agents command as follows:

A live agent will give us the following information when the preceding command is executed:

• Name of the agent (Name)
• Launcher used by the stager (La) - PowerShell or Python
• Internal IP
• Machine name
• Username with the domain
• Process
• Process ID (PID)
• Delay with jitters
• Last seen

Instead of using the agents command, we can also use the list command to see all of the available agents. However, this will only work if we are in the agent's menu (Empire: ...