rule_empire_offensive_tool_keyword
YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'empire' taken from the ThreatHunting-Keywords github project
rule rule_empire_offensive_tool_keyword
{
meta:
description = "Detection patterns for the tool 'empire' taken from the ThreatHunting-Keywords github project"
author = "@mthcht"
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
tool = "empire"
rule_category = "offensive_tool_keyword"
strings:
$string1_empire_offensive_tool_keyword = /\s\$FodHelperPath/ nocase ascii wide
$string2_empire_offensive_tool_keyword = " -AgentDelay " nocase ascii wide
$string3_empire_offensive_tool_keyword = " -AgentJitter " nocase ascii wide
$string4_empire_offensive_tool_keyword = " -bootkey " nocase ascii wide
$string5_empire_offensive_tool_keyword = /\s\-ChildPath\s.{0,100}fodhelper\.exe/ nocase ascii wide
$string6_empire_offensive_tool_keyword = /\s\-ChildPath\s.{0,100}sdclt\.exe/ nocase ascii wide
$string7_empire_offensive_tool_keyword = " -CollectionMethod stealth" nocase ascii wide
$string8_empire_offensive_tool_keyword = " -ComputerName -ServiceEXE " nocase ascii wide
$string9_empire_offensive_tool_keyword = " -ConType bind " nocase ascii wide
$string10_empire_offensive_tool_keyword = " -ConType reverse " nocase ascii wide
$string11_empire_offensive_tool_keyword = " -CShardDLLBytes" nocase ascii wide
$string12_empire_offensive_tool_keyword = /\s\-DllName\s.{0,100}\s\-FunctionName\s/ nocase ascii wide
$string13_empire_offensive_tool_keyword = /\s\-Domain\s.{0,100}\s\-SMB1\s/ nocase ascii wide
$string14_empire_offensive_tool_keyword = " -DoNotPersistImmediately " nocase ascii wide
$string15_empire_offensive_tool_keyword = " -DumpCerts " nocase ascii wide
$string16_empire_offensive_tool_keyword = " -DumpCreds " nocase ascii wide
$string17_empire_offensive_tool_keyword = /\s\-DumpForest\s\-Users\s.{0,100}krbtgt/ nocase ascii wide
$string18_empire_offensive_tool_keyword = " -ElevatedPersistenceOption " nocase ascii wide
$string19_empire_offensive_tool_keyword = /\sempire\.arguments/ nocase ascii wide
$string20_empire_offensive_tool_keyword = /\sempire\.client\./ nocase ascii wide
$string21_empire_offensive_tool_keyword = /\sempire\.py/ nocase ascii wide
$string22_empire_offensive_tool_keyword = /\s\-Enumerate\s.{0,100}\s\-Module\s/ nocase ascii wide
$string23_empire_offensive_tool_keyword = " -ExeArguments " nocase ascii wide
$string24_empire_offensive_tool_keyword = /\s\-FullPrivs\s.{0,100}\s/ nocase ascii wide
$string25_empire_offensive_tool_keyword = /\s\-GHUser\s.{0,100}\s\-GHRepo\s/ nocase ascii wide
$string26_empire_offensive_tool_keyword = /\s\-Hosts\s.{0,100}\s\-TopPorts\s/ nocase ascii wide
$string27_empire_offensive_tool_keyword = " http_malleable" nocase ascii wide
$string28_empire_offensive_tool_keyword = " -ImpersonateUser " nocase ascii wide
$string29_empire_offensive_tool_keyword = " -ImportDllPathPtr " nocase ascii wide
$string30_empire_offensive_tool_keyword = " Inveigh-" nocase ascii wide
$string31_empire_offensive_tool_keyword = " -JMXConsole -AppName " nocase ascii wide
$string32_empire_offensive_tool_keyword = " -KillDate " nocase ascii wide
$string33_empire_offensive_tool_keyword = " -KillDays " nocase ascii wide
$string34_empire_offensive_tool_keyword = " -LLMNRTTL " nocase ascii wide
$string35_empire_offensive_tool_keyword = /\s\-LNKPath\s.{0,100}\s\-EncScript\s/ nocase ascii wide
$string36_empire_offensive_tool_keyword = " -mDNSTTL " nocase ascii wide
$string37_empire_offensive_tool_keyword = " -NBNSTTL " nocase ascii wide
$string38_empire_offensive_tool_keyword = " net localgroup administrators Tater /add" nocase ascii wide
$string39_empire_offensive_tool_keyword = " -NoBase64 " nocase ascii wide
$string40_empire_offensive_tool_keyword = " -NoP -sta -NonI -W Hidden -Enc " nocase ascii wide
$string41_empire_offensive_tool_keyword = " -p 1337:1337 -p 5000:5000" nocase ascii wide
$string42_empire_offensive_tool_keyword = " -PasswordList " nocase ascii wide
$string43_empire_offensive_tool_keyword = /\s\-payload\s.{0,100}\-Lhost\s.{0,100}\-Lport/ nocase ascii wide
$string44_empire_offensive_tool_keyword = " -PayloadPath " nocase ascii wide
$string45_empire_offensive_tool_keyword = /\s\-PEPath\s.{0,100}\s\-ExeArgs\s/ nocase ascii wide
$string46_empire_offensive_tool_keyword = " -PermanentWMI " nocase ascii wide
$string47_empire_offensive_tool_keyword = " -PersistenceScriptName " nocase ascii wide
$string48_empire_offensive_tool_keyword = " -PersistentScriptFilePath " nocase ascii wide
$string49_empire_offensive_tool_keyword = " --port 1337" nocase ascii wide
$string50_empire_offensive_tool_keyword = " -PWDumpFormat " nocase ascii wide
$string51_empire_offensive_tool_keyword = " -Registry -AtStartup " nocase ascii wide
$string52_empire_offensive_tool_keyword = " -RemoteDllHandle " nocase ascii wide
$string53_empire_offensive_tool_keyword = " -RevToSelf " nocase ascii wide
$string54_empire_offensive_tool_keyword = /\s\-Rhost\s.{0,100}\s\-WARFile\shttp/ nocase ascii wide
$string55_empire_offensive_tool_keyword = /\s\-Rhosts\s.{0,100}\s\-Password\s.{0,100}\s\-Directory\s.{0,100}\s\-Dictionary\s/ nocase ascii wide
$string56_empire_offensive_tool_keyword = /\s\-Rhosts\s.{0,100}\s\-Path\s.{0,100}\.txt\s\-Port\s/ nocase ascii wide
$string57_empire_offensive_tool_keyword = " -ScheduledTask -OnIdle " nocase ascii wide
$string58_empire_offensive_tool_keyword = /\s\-ServiceName\s.{0,100}\s\-PipeName\s/ nocase ascii wide
$string59_empire_offensive_tool_keyword = " Set-MasterBootRecord" nocase ascii wide
$string60_empire_offensive_tool_keyword = /\s\-SiteListFilePath\s.{0,100}\s\-B64Pass\s/ nocase ascii wide
$string61_empire_offensive_tool_keyword = " SnifferSpoofer" nocase ascii wide
$string62_empire_offensive_tool_keyword = " -SpooferIP " nocase ascii wide
$string63_empire_offensive_tool_keyword = /\s\-Target\s.{0,100}\s\-AllDomain\s/ nocase ascii wide
$string64_empire_offensive_tool_keyword = /\s\-Target\s.{0,100}\s\-InitialGrooms\s/ nocase ascii wide
$string65_empire_offensive_tool_keyword = /\s\-Target\s.{0,100}\s\-Shellcode\s/ nocase ascii wide
$string66_empire_offensive_tool_keyword = /\s\-type\suser\s\-search\s.{0,100}\s\-DomainController\s.{0,100}\s\-Credential\s.{0,100}\s\-list\syes/ nocase ascii wide
$string67_empire_offensive_tool_keyword = /\s\-UserList\s.{0,100}\s\-Domain\s.{0,100}\s\-PasswordList\s.{0,100}\s\-OutFile\s/ nocase ascii wide
$string68_empire_offensive_tool_keyword = /\s\-Username\s.{0,100}\s\-Hash\s.{0,100}\s\-Command\s/ nocase ascii wide
$string69_empire_offensive_tool_keyword = " -UserPersistenceOption " nocase ascii wide
$string70_empire_offensive_tool_keyword = " -VaultElementPtr " nocase ascii wide
$string71_empire_offensive_tool_keyword = " windows/csharp_exe" nocase ascii wide
$string72_empire_offensive_tool_keyword = " -WorkingHours " nocase ascii wide
$string73_empire_offensive_tool_keyword = " Your payload has been delivered" nocase ascii wide
$string74_empire_offensive_tool_keyword = /\$PipeName\s\=\s\\"TestSVC\\"/ nocase ascii wide
$string75_empire_offensive_tool_keyword = /\$Taskname\=\\"Tater\\"/ nocase ascii wide
$string76_empire_offensive_tool_keyword = "//localhost:1337" nocase ascii wide
$string77_empire_offensive_tool_keyword = /\/api\/admin\/shutdown\?token\=/ nocase ascii wide
$string78_empire_offensive_tool_keyword = /\/api\/agents\/.{0,100}\/kill\?token\=/ nocase ascii wide
$string79_empire_offensive_tool_keyword = /\/api\/agents\/all\/kill\?token\=/ nocase ascii wide
$string80_empire_offensive_tool_keyword = /\/api\/agents\/all\/shell\?token\=/ nocase ascii wide
$string81_empire_offensive_tool_keyword = /\/api\/agents\/CXPLDTZCKFNT3SLT\/shell\?/ nocase ascii wide
$string82_empire_offensive_tool_keyword = /\/api\/agents\/stale\?token\=/ nocase ascii wide
$string83_empire_offensive_tool_keyword = /\/api\/agents\/XMY2H2ZPFWNPGEAP\?token\=/ nocase ascii wide
$string84_empire_offensive_tool_keyword = /\/api\/listeners\/all\?token\=/ nocase ascii wide
$string85_empire_offensive_tool_keyword = /\/api\/modules\/collection\/.{0,100}\?token\=/ nocase ascii wide
$string86_empire_offensive_tool_keyword = /\/api\/modules\/credentials.{0,100}\?token\=/ nocase ascii wide
$string87_empire_offensive_tool_keyword = /\/api\/reporting\/agent\/initial\?token\=/ nocase ascii wide
$string88_empire_offensive_tool_keyword = /\/api\/reporting\/msg\/.{0,100}\?token\=/ nocase ascii wide
$string89_empire_offensive_tool_keyword = /\/api\/reporting\/type\/checkin\?token\=/ nocase ascii wide
$string90_empire_offensive_tool_keyword = /\/api\/stagers\/dll\?token\=/ nocase ascii wide
$string91_empire_offensive_tool_keyword = /\/api\/stagers\?token\=/ nocase ascii wide
$string92_empire_offensive_tool_keyword = /\/api\/users\/1\/disable\?token\=/ nocase ascii wide
$string93_empire_offensive_tool_keyword = "/api/v2/starkiller" nocase ascii wide
$string94_empire_offensive_tool_keyword = "/client/generated-stagers/" nocase ascii wide
$string95_empire_offensive_tool_keyword = /\/data\/empire\.db/ nocase ascii wide
$string96_empire_offensive_tool_keyword = /\/data\/empire\.orig\.key/ nocase ascii wide
$string97_empire_offensive_tool_keyword = /\/download\-stager\.js/ nocase ascii wide
$string98_empire_offensive_tool_keyword = /\/ducky\.py/ nocase ascii wide
$string99_empire_offensive_tool_keyword = /\/Empire\.git/ nocase ascii wide
$string100_empire_offensive_tool_keyword = "/empire/client/" nocase ascii wide
$string101_empire_offensive_tool_keyword = "/empire:latest" nocase ascii wide
$string102_empire_offensive_tool_keyword = /\/empire\-chain\.pem/ nocase ascii wide
$string103_empire_offensive_tool_keyword = "/EmpireProject" nocase ascii wide
$string104_empire_offensive_tool_keyword = "/evilhost:" nocase ascii wide
$string105_empire_offensive_tool_keyword = /\/Get\-LsaSecret\./ nocase ascii wide
$string106_empire_offensive_tool_keyword = /\/hop\.php/ nocase ascii wide
$string107_empire_offensive_tool_keyword = /\/HTTP\-Login\.ps1/ nocase ascii wide
$string108_empire_offensive_tool_keyword = /\/Invoke\-RunAs\.ps1/ nocase ascii wide
$string109_empire_offensive_tool_keyword = "/lateral_movement/" nocase ascii wide
$string110_empire_offensive_tool_keyword = /\/lateral_movement\/.{0,100}\.ps1/ nocase ascii wide
$string111_empire_offensive_tool_keyword = /\/logs\/empire_server\.log/ nocase ascii wide
$string112_empire_offensive_tool_keyword = /\/MailRaider\.ps1/ nocase ascii wide
$string113_empire_offensive_tool_keyword = "/network/bloodhound3" nocase ascii wide
$string114_empire_offensive_tool_keyword = /\/persistence\/.{0,100}\.ps1/ nocase ascii wide
$string115_empire_offensive_tool_keyword = /\/persistence\/.{0,100}\.psm1/ nocase ascii wide
$string116_empire_offensive_tool_keyword = "/privesc/" nocase ascii wide
$string117_empire_offensive_tool_keyword = "/ps-empire" nocase ascii wide
$string118_empire_offensive_tool_keyword = "/ReferenceSourceLibraries/Sharpire" nocase ascii wide
$string119_empire_offensive_tool_keyword = /\/server\/common\/stagers\.py/ nocase ascii wide
$string120_empire_offensive_tool_keyword = /\/Sharpire\.exe/ nocase ascii wide
$string121_empire_offensive_tool_keyword = /\/situational_awareness\/.{0,100}\.exe/ nocase ascii wide
$string122_empire_offensive_tool_keyword = /\/situational_awareness\/.{0,100}\.ps1/ nocase ascii wide
$string123_empire_offensive_tool_keyword = /\/smb\/psexec\.rb/ nocase ascii wide
$string124_empire_offensive_tool_keyword = /\/sprayed\-creds\.txt/ nocase ascii wide
$string125_empire_offensive_tool_keyword = /\/stagers\/.{0,100}\.ps1/ nocase ascii wide
$string126_empire_offensive_tool_keyword = "/stagers/CSharpPS" nocase ascii wide
$string127_empire_offensive_tool_keyword = "/tmp/empire"
$string128_empire_offensive_tool_keyword = /\/tools\/psexec\.rb/ nocase ascii wide
$string129_empire_offensive_tool_keyword = "/trollsploit/" nocase ascii wide
$string130_empire_offensive_tool_keyword = /\/x64_slim\.dll/ nocase ascii wide
$string131_empire_offensive_tool_keyword = /\/xar\-1\.5\.2\.tar\.gz/ nocase ascii wide
$string132_empire_offensive_tool_keyword = /\\EmpireCompiler\.dll/ nocase ascii wide
$string133_empire_offensive_tool_keyword = /\\hijackers\\/ nocase ascii wide
$string134_empire_offensive_tool_keyword = /\\PSRansom\.ps1/ nocase ascii wide
$string135_empire_offensive_tool_keyword = /\\Sharpire\.exe/ nocase ascii wide
$string136_empire_offensive_tool_keyword = /\\sprayed\-creds\.txt/ nocase ascii wide
$string137_empire_offensive_tool_keyword = /\\Temp\\blah\.exe/ nocase ascii wide
$string138_empire_offensive_tool_keyword = /\\UACBypassTest\.txt/ nocase ascii wide
$string139_empire_offensive_tool_keyword = "0207936279f3e40608ea72aae76312c3e5485f6eabd041d5c690f485c523a795" nocase ascii wide
$string140_empire_offensive_tool_keyword = "0c79bc58224e71882e48b6230f3a90ec516f30ba8a6a431f7d2f6323de581a81" nocase ascii wide
$string141_empire_offensive_tool_keyword = "0fa7194f72ad2e12774792f48c2cc01e4828356087210370acdd9c66b67f818b" nocase ascii wide
$string142_empire_offensive_tool_keyword = "10226b3b8594c981077a5e415bd98787c94b6f3f2ca48a50089fdf3f2c2547e8" nocase ascii wide
$string143_empire_offensive_tool_keyword = "1085654ad66ba105edeca8e068047afdcec8f3d35aaa2dc09cf5cb5518971e15" nocase ascii wide
$string144_empire_offensive_tool_keyword = "12da3e3bfe44e83838a66ed2c8cbaf3fd7153b815d21dd14c2f8de2f10130b3d" nocase ascii wide
$string145_empire_offensive_tool_keyword = /1337.{0,100}\/api\/agents\/.{0,100}\/results\?token\=/ nocase ascii wide
$string146_empire_offensive_tool_keyword = /1337.{0,100}\/api\/creds\?token\=/ nocase ascii wide
$string147_empire_offensive_tool_keyword = /1337.{0,100}\/api\/listeners\?token\=/ nocase ascii wide
$string148_empire_offensive_tool_keyword = "15065a09f2a944aa4376a3efe035b209f2c9617be19e08640320fb874e0e991c" nocase ascii wide
$string149_empire_offensive_tool_keyword = "1ee8a433f650466547e5003bcf470eb70cfcaee27cbebae2f55adbcbacd6bf40" nocase ascii wide
$string150_empire_offensive_tool_keyword = "21f37987d11f82d9a0b38b6caca5b5c7967172f3204c8ecc98cb3a5033097467" nocase ascii wide
$string151_empire_offensive_tool_keyword = "242edf5f22175e7bb921568de525cd1469c3462fbb5943a04f2cc681cff764f4" nocase ascii wide
$string152_empire_offensive_tool_keyword = "24b6f5f69fbc819dcfbdaa0efcfbf5a71f26f651e5c2310ebe495b193f89cce9" nocase ascii wide
$string153_empire_offensive_tool_keyword = "25110aab44570c065061044d38afc50eea45ca5f78bb2b70b0941d63c979cf62" nocase ascii wide
$string154_empire_offensive_tool_keyword = "285a2bf9a6a6a90d942d0c20832f5c0722e3aa557498cd1b6208b52932bbc18d" nocase ascii wide
$string155_empire_offensive_tool_keyword = "2873fe0d14429c67afb56a58407a9ac664b395eb0fa7c8101f69b055e3f747fa" nocase ascii wide
$string156_empire_offensive_tool_keyword = "2c0a644ec77673d8ec16808a8ac299733ee6e91a3fed0c8da41d6d73812b0d29" nocase ascii wide
$string157_empire_offensive_tool_keyword = "2e70433f8b5f60e28dbd95757dd4bf967fa744142deac4b3bcb0d3b11cb99753" nocase ascii wide
$string158_empire_offensive_tool_keyword = "32cd91c759b8cb4efca9582ee8ff760f1121f109a5e54a6c6da956713ef81f0f" nocase ascii wide
$string159_empire_offensive_tool_keyword = "3644992e6ddad57730c25549175afaded580cd12226675105f71525e7d089d24" nocase ascii wide
$string160_empire_offensive_tool_keyword = "382c77a7693178867a24912db26b69a1fe5d508cde83ea89309758ef5d001e44" nocase ascii wide
$string161_empire_offensive_tool_keyword = "41792ea386bced0624ba2066ed3616167eebb93212f6751e60382c0ba10a9e59" nocase ascii wide
$string162_empire_offensive_tool_keyword = "4ed4145e2a1ea00c2cf463f86d627341b58d0e0887ae317ebfce6dd5d48f8749" nocase ascii wide
$string163_empire_offensive_tool_keyword = "573b83b3dc86832085eca5958fa11c0b5874edb3fdf84a016a21a8cc40454ea2" nocase ascii wide
$string164_empire_offensive_tool_keyword = "59d6b8ce447b8168f7d17f18a1584dd54c543fed2b35a5b76c49c034e20dffe2" nocase ascii wide
$string165_empire_offensive_tool_keyword = "5aef3aec6cf7fd4f2a1b1f82768092cf7c861f3f4efb8d7b1764c51f4620e946" nocase ascii wide
$string166_empire_offensive_tool_keyword = "618af083df8944b89618a4bed2d4be44f901f3b9659f066d6e210ec0cb92e603" nocase ascii wide
$string167_empire_offensive_tool_keyword = "6be97bfbc4bdb40ea061c20d75d0c812de61b262c96f891a438fdd280aad4c6f" nocase ascii wide
$string168_empire_offensive_tool_keyword = "6ecb62923d16588654c77ad581388eb27873b09c2ff642cd8303c8a2d577fe53" nocase ascii wide
$string169_empire_offensive_tool_keyword = "722e522f4029a9e0eb3ce298d28949e304b797d242cd4ae8f81e0530ca0acc8f" nocase ascii wide
$string170_empire_offensive_tool_keyword = "77db549ca1d8238056074d8abda0c1715bb69f1c0b85795f1680c20960e6a757" nocase ascii wide
$string171_empire_offensive_tool_keyword = "798ccfbf2e5c14077023d9236363c6e6ebf3bc6b28b551c01b00e272863bdcc7" nocase ascii wide
$string172_empire_offensive_tool_keyword = "7e4fc58a02442bd5021c2a0b1bc032a1b65dfa1dbb182fc9a13e4716da7c51d9" nocase ascii wide
$string173_empire_offensive_tool_keyword = "7e5d70e9ea31688ed3b6192e0f4bc7ba02b6d3fc772598ac187c02275a44cc02" nocase ascii wide
$string174_empire_offensive_tool_keyword = "7fdf7529eb3c25f47136fa12a74040e38f4eda6cdd66f760977e537a292abea6" nocase ascii wide
$string175_empire_offensive_tool_keyword = "841f439c8f42ffe1fa88303a9d7fd8268b6cdf9dd8b91704ba2dd8a7b8f813a3" nocase ascii wide
$string176_empire_offensive_tool_keyword = "86943e3a790e194a2f76aa2c4ed2832e19fe4e7a45eeebe5f5bc62fd16825bd5" nocase ascii wide
$string177_empire_offensive_tool_keyword = "8da1165d0f8bc514c82d5818ac89bb7a5e31d1f78258ac8beecb7b73fc5d857a" nocase ascii wide
$string178_empire_offensive_tool_keyword = "91a40fb5af592e1b63099fb236a1c955b47c4699197651b9ae1507ecbf4ad2ea" nocase ascii wide
$string179_empire_offensive_tool_keyword = "95df94b5f2e9428ee39f9f6706fd746a116a8afe9eeb3b318c576bbb934e35a4" nocase ascii wide
$string180_empire_offensive_tool_keyword = "96023f92abefc6b2196bda989320836075a1fa402106fd7cc8fb546bc09502b7" nocase ascii wide
$string181_empire_offensive_tool_keyword = "9fb43934f7fab913cd91847ca228bba739f98f58074bcedd50a912a71b313c5c" nocase ascii wide
$string182_empire_offensive_tool_keyword = "a4a394d85597168c85a244e6ec4d8ff7c8a92f3938bf40dac9ba5a0ce9803d05" nocase ascii wide
$string183_empire_offensive_tool_keyword = "a58fa5635efa5a680c1861aca8a2e630b4031dadb901fe36df5e1f7018948275" nocase ascii wide
$string184_empire_offensive_tool_keyword = "ACBypassTest" nocase ascii wide
$string185_empire_offensive_tool_keyword = "Add-Persistence" nocase ascii wide
$string186_empire_offensive_tool_keyword = "Add-PSFirewallRules" nocase ascii wide
$string187_empire_offensive_tool_keyword = "apt install powershell-empire" nocase ascii wide
$string188_empire_offensive_tool_keyword = "bc2ef0da409c8c1a026e13d11b4cf32995e4a7e742c097ca9d1594aba8d3d4e3" nocase ascii wide
$string189_empire_offensive_tool_keyword = "bc-security/empire" nocase ascii wide
$string190_empire_offensive_tool_keyword = "bcsecurity/empire:latest" nocase ascii wide
$string191_empire_offensive_tool_keyword = "BC-SECURITY/Starkiller" nocase ascii wide
$string192_empire_offensive_tool_keyword = "Bitmap-Elevate" nocase ascii wide
$string193_empire_offensive_tool_keyword = /BloodHound\.ps1/ nocase ascii wide
$string194_empire_offensive_tool_keyword = /BloodHound3\.ps1/ nocase ascii wide
$string195_empire_offensive_tool_keyword = "Building SYSTEM impersonation" nocase ascii wide
$string196_empire_offensive_tool_keyword = "BypassUACTokenManipulation" nocase ascii wide
$string197_empire_offensive_tool_keyword = "c12cad06d0e93742fd0ce0c698c654ff3c86b567dcc4102cd2c5d931d77dcc64" nocase ascii wide
$string198_empire_offensive_tool_keyword = "c5b69369f46c94d6c1ac5c2f3808be48fa6d790c7d7d909d82850cc8774a14ac" nocase ascii wide
$string199_empire_offensive_tool_keyword = "c85c649826d3f0cb619861663dbc70669e6705eec03ddb383fc9ef92125aaf25" nocase ascii wide
$string200_empire_offensive_tool_keyword = "c93ff0ad29732505e9679eed6561ceef907bcb1f5df9b6a588c23e484df85681" nocase ascii wide
$string201_empire_offensive_tool_keyword = "cc3f112ed5af9b0b4de3ab165c1a08b0d3d24323f8492f0513a0af9e06e95eff" nocase ascii wide
$string202_empire_offensive_tool_keyword = /code_execution\/.{0,100}\.dll/ nocase ascii wide
$string203_empire_offensive_tool_keyword = /code_execution\/.{0,100}\.exe/ nocase ascii wide
$string204_empire_offensive_tool_keyword = /code_execution\/.{0,100}\.ps1/ nocase ascii wide
$string205_empire_offensive_tool_keyword = "ConvertFrom-LDAPLogonHours" nocase ascii wide
$string206_empire_offensive_tool_keyword = "ConvertTo-LogonHoursArray" nocase ascii wide
$string207_empire_offensive_tool_keyword = "ConvertTo-Rc4ByteStream" nocase ascii wide
$string208_empire_offensive_tool_keyword = "Create-NamedPipe" nocase ascii wide
$string209_empire_offensive_tool_keyword = "Create-SuspendedWinLogon" nocase ascii wide
$string210_empire_offensive_tool_keyword = "Create-WinLogonProcess" nocase ascii wide
$string211_empire_offensive_tool_keyword = "csharp_inject_bof_inject" nocase ascii wide
$string212_empire_offensive_tool_keyword = "D5865774-CD82-4CCE-A3F1-7F2C4639301B" nocase ascii wide
$string213_empire_offensive_tool_keyword = "d78fa8da51c45a84c22819f0ab4f2b77135c9e8b48f693dde65384ecc3b8636c" nocase ascii wide
$string214_empire_offensive_tool_keyword = "d7e3d2ef31bf5905d593420dbd3aa92e709d2524fa63ffa0bb3b75dc2ddc408f" nocase ascii wide
$string215_empire_offensive_tool_keyword = "Decode-RoutingPacket" nocase ascii wide
$string216_empire_offensive_tool_keyword = "DecryptNextCharacterWinSCP" nocase ascii wide
$string217_empire_offensive_tool_keyword = "DecryptWinSCPPassword" nocase ascii wide
$string218_empire_offensive_tool_keyword = "dedc1f4578fd081f28e2cca23dcb518fad39f9f782755bfa33e9723f32bb4487" nocase ascii wide
$string219_empire_offensive_tool_keyword = "Discover-PSMSExchangeServers" nocase ascii wide
$string220_empire_offensive_tool_keyword = "Discover-PSMSSQLServers" nocase ascii wide
$string221_empire_offensive_tool_keyword = /\-DllInjection\.ps1/ nocase ascii wide
$string222_empire_offensive_tool_keyword = /\-DllName\s.{0,100}\-Module\s/ nocase ascii wide
$string223_empire_offensive_tool_keyword = "Do-AltShiftEsc" nocase ascii wide
$string224_empire_offensive_tool_keyword = "Do-AltShiftTab" nocase ascii wide
$string225_empire_offensive_tool_keyword = "docker run -it -p 1337:1337 -p 5000:5000 " nocase ascii wide
$string226_empire_offensive_tool_keyword = /\-Domain\s.{0,100}\s\-AllowDelegation\s/ nocase ascii wide
$string227_empire_offensive_tool_keyword = /\-Domain\s.{0,100}\s\-SPN\s/ nocase ascii wide
$string228_empire_offensive_tool_keyword = /download\s.{0,100}bloodhound/ nocase ascii wide
$string229_empire_offensive_tool_keyword = "DownloadAndExtractFromRemoteRegistry" nocase ascii wide
$string230_empire_offensive_tool_keyword = /dumpCredStore\.ps1/ nocase ascii wide
$string231_empire_offensive_tool_keyword = "-DumpForest " nocase ascii wide
$string232_empire_offensive_tool_keyword = "e17b62d1052bbed122fd65f701fe79600dc84b9dc9d4cd1e17c1dca2cc2c2e71" nocase ascii wide
$string233_empire_offensive_tool_keyword = "e55c296872a04e46369c46c23bae5707cd7d2e079a2f8350015475b5eecd3e17" nocase ascii wide
$string234_empire_offensive_tool_keyword = "e8e5705168a9c66d1a4cf17d3ef2928b9141bffa3ca28a0482536e7900975a87" nocase ascii wide
$string235_empire_offensive_tool_keyword = /echo\s.{0,100}\s\>\s\\\\\.\\pipe\\/ nocase ascii wide
$string236_empire_offensive_tool_keyword = "ee58b36f91a49518422e7eab0fd0c82c9a154f95ae9dde863a02bc4da7ff398c" nocase ascii wide
$string237_empire_offensive_tool_keyword = "egresscheck-framework" nocase ascii wide
$string238_empire_offensive_tool_keyword = "ElevatePrivs" nocase ascii wide
$string239_empire_offensive_tool_keyword = "Empire Framework GUI" nocase ascii wide
$string240_empire_offensive_tool_keyword = "empire --rest " nocase ascii wide
$string241_empire_offensive_tool_keyword = "empire --server " nocase ascii wide
$string242_empire_offensive_tool_keyword = /empire\.server\.api\.v2/ nocase ascii wide
$string243_empire_offensive_tool_keyword = /empire\/client\/.{0,100}\.py/ nocase ascii wide
$string244_empire_offensive_tool_keyword = /empire\/server\/.{0,100}\.py/ nocase ascii wide
$string245_empire_offensive_tool_keyword = "empire/server/downloads/" nocase ascii wide
$string246_empire_offensive_tool_keyword = "empire/server/downloads/logs/" nocase ascii wide
$string247_empire_offensive_tool_keyword = "empire/server/downloads/logs/" nocase ascii wide
$string248_empire_offensive_tool_keyword = /Empire\@bc\-security\.org/ nocase ascii wide
$string249_empire_offensive_tool_keyword = /empire_server\./ nocase ascii wide
$string250_empire_offensive_tool_keyword = "empireadmin" nocase ascii wide
$string251_empire_offensive_tool_keyword = /empire\-chain\.pem/ nocase ascii wide
$string252_empire_offensive_tool_keyword = "EmpireCORSMiddleware" nocase ascii wide
$string253_empire_offensive_tool_keyword = /Empire\-GUI\.git/ nocase ascii wide
$string254_empire_offensive_tool_keyword = "Empire-master" nocase ascii wide
$string255_empire_offensive_tool_keyword = /empire\-priv\.key/ nocase ascii wide
$string256_empire_offensive_tool_keyword = "EmpireProject" nocase ascii wide
$string257_empire_offensive_tool_keyword = /Empire\-Sponsors\.git/ nocase ascii wide
$string258_empire_offensive_tool_keyword = "empire-test-kalirolling" nocase ascii wide
$string259_empire_offensive_tool_keyword = "Enable-SeAssignPrimaryTokenPrivilege" nocase ascii wide
$string260_empire_offensive_tool_keyword = "Enable-SeDebugPrivilege" nocase ascii wide
$string261_empire_offensive_tool_keyword = "Encrypt-Bytes" nocase ascii wide
$string262_empire_offensive_tool_keyword = "Enum-AllTokens" nocase ascii wide
$string263_empire_offensive_tool_keyword = "Enum-Creds" nocase ascii wide
$string264_empire_offensive_tool_keyword = /EternalBlue\.ps1/ nocase ascii wide
$string265_empire_offensive_tool_keyword = "-EventVwrBypass" nocase ascii wide
$string266_empire_offensive_tool_keyword = "ExfilDataToGitHub" nocase ascii wide
$string267_empire_offensive_tool_keyword = /Exploit\-EternalBlue\.ps1/ nocase ascii wide
$string268_empire_offensive_tool_keyword = "Exploit-JBoss -" nocase ascii wide
$string269_empire_offensive_tool_keyword = /Exploit\-JBoss\.ps1/ nocase ascii wide
$string270_empire_offensive_tool_keyword = "Exploit-Jenkins" nocase ascii wide
$string271_empire_offensive_tool_keyword = /Exploit\-Jenkins\.ps1/ nocase ascii wide
$string272_empire_offensive_tool_keyword = "Exploit-JMXConsole" nocase ascii wide
$string273_empire_offensive_tool_keyword = "Export-PowerViewCSV" nocase ascii wide
$string274_empire_offensive_tool_keyword = "f04b79d7179c98ce705876849a20f67bcff5c977f4f7865226e26296f1e80966" nocase ascii wide
$string275_empire_offensive_tool_keyword = "f3e392c770e87e69c6af2d3e83bd4b6190e6e09ce4aa4a681316dbb11582e1b3" nocase ascii wide
$string276_empire_offensive_tool_keyword = "f7e5471eda155f8ff46a63d00cab80b18a7eb62cbd1865d30bcff1b074af1887" nocase ascii wide
$string277_empire_offensive_tool_keyword = "fbd9f058f3838363b1f6f3e63b22ae60532af2f21f5c73b18899c9b0b888e3f3" nocase ascii wide
$string278_empire_offensive_tool_keyword = "febf23d1ae51d53d18aff75baa9b3c8f13775b5399e6d15ad138d1a9dcc2b871" nocase ascii wide
$string279_empire_offensive_tool_keyword = /Fetch\-And\-Brute\-Local\-Accounts\.ps1/ nocase ascii wide
$string280_empire_offensive_tool_keyword = "Find-4624Logons" nocase ascii wide
$string281_empire_offensive_tool_keyword = "Find-4648Logons" nocase ascii wide
$string282_empire_offensive_tool_keyword = "Find-AppLockerLogs" nocase ascii wide
$string283_empire_offensive_tool_keyword = "Find-DLLHijack" nocase ascii wide
$string284_empire_offensive_tool_keyword = "Find-DomainShare -" nocase ascii wide
$string285_empire_offensive_tool_keyword = "Find-DomainShare -CheckShareAccess" nocase ascii wide
$string286_empire_offensive_tool_keyword = /Find\-Fruit\./ nocase ascii wide
$string287_empire_offensive_tool_keyword = /Find\-Fruit\.ps1/ nocase ascii wide
$string288_empire_offensive_tool_keyword = "Find-InterestingDomainAcl" nocase ascii wide
$string289_empire_offensive_tool_keyword = "Find-InterestingDomainShareFile" nocase ascii wide
$string290_empire_offensive_tool_keyword = "Find-KeePassconfig" nocase ascii wide
$string291_empire_offensive_tool_keyword = "Find-LocalAdminAccess" nocase ascii wide
$string292_empire_offensive_tool_keyword = "Find-PathDLLHijack" nocase ascii wide
$string293_empire_offensive_tool_keyword = "Find-PathHijack" nocase ascii wide
$string294_empire_offensive_tool_keyword = "Find-ProcessDLLHijack" nocase ascii wide
$string295_empire_offensive_tool_keyword = "Find-PSScriptsInPSAppLog" nocase ascii wide
$string296_empire_offensive_tool_keyword = "Find-RDPClientConnections" nocase ascii wide
$string297_empire_offensive_tool_keyword = "Find-TrustedDocuments" nocase ascii wide
$string298_empire_offensive_tool_keyword = /Find\-TrustedDocuments\.ps1/ nocase ascii wide
$string299_empire_offensive_tool_keyword = "Find-UserField -SearchField " nocase ascii wide
$string300_empire_offensive_tool_keyword = "Find-WMILocalAdminAccess" nocase ascii wide
$string301_empire_offensive_tool_keyword = "function psenum" nocase ascii wide
$string302_empire_offensive_tool_keyword = "generate_powershell_exe" nocase ascii wide
$string303_empire_offensive_tool_keyword = "generate_powershell_shellcode" nocase ascii wide
$string304_empire_offensive_tool_keyword = "generate_python_exe" nocase ascii wide
$string305_empire_offensive_tool_keyword = "generate_python_shellcode" nocase ascii wide
$string306_empire_offensive_tool_keyword = "generate_stageless" nocase ascii wide
$string307_empire_offensive_tool_keyword = "Get-ActiveTCPConnections" nocase ascii wide
$string308_empire_offensive_tool_keyword = /Get\-and\-Brute\-LocalAccount\.ps1/ nocase ascii wide
$string309_empire_offensive_tool_keyword = /Get\-AppLockerConfig\.ps1/ nocase ascii wide
$string310_empire_offensive_tool_keyword = "Get-BloodHoundData" nocase ascii wide
$string311_empire_offensive_tool_keyword = "Get-BootKey" nocase ascii wide
$string312_empire_offensive_tool_keyword = /Get\-BrowserData\.ps1/ nocase ascii wide
$string313_empire_offensive_tool_keyword = "Get-BrowserInformation" nocase ascii wide
$string314_empire_offensive_tool_keyword = "Get-CachedGPPPassword" nocase ascii wide
$string315_empire_offensive_tool_keyword = "Get-ChromeBookmarks" nocase ascii wide
$string316_empire_offensive_tool_keyword = "Get-ChromeDump" nocase ascii wide
$string317_empire_offensive_tool_keyword = "Get-ChromeDump" nocase ascii wide
$string318_empire_offensive_tool_keyword = /Get\-ChromeDump\.ps1/ nocase ascii wide
$string319_empire_offensive_tool_keyword = "Get-ChromeHistory" nocase ascii wide
$string320_empire_offensive_tool_keyword = "Get-ClipboardContents" nocase ascii wide
$string321_empire_offensive_tool_keyword = /Get\-ClipboardContents\.ps1/ nocase ascii wide
$string322_empire_offensive_tool_keyword = /Get\-ComputerDetails\.ps1/ nocase ascii wide
$string323_empire_offensive_tool_keyword = "GetComputersFromActiveDirectory" nocase ascii wide
$string324_empire_offensive_tool_keyword = "Get-DCBadPwdCount" nocase ascii wide
$string325_empire_offensive_tool_keyword = "Get-DecryptedCpassword" nocase ascii wide
$string326_empire_offensive_tool_keyword = "Get-DecryptedSitelistPassword" nocase ascii wide
$string327_empire_offensive_tool_keyword = "Get-DomainDFSshare" nocase ascii wide
$string328_empire_offensive_tool_keyword = "Get-DomainDFSShareV1" nocase ascii wide
$string329_empire_offensive_tool_keyword = "Get-DomainDFSShareV2" nocase ascii wide
$string330_empire_offensive_tool_keyword = "Get-DomainFileServer" nocase ascii wide
$string331_empire_offensive_tool_keyword = "Get-DomainForeignUser" nocase ascii wide
$string332_empire_offensive_tool_keyword = "Get-DomainGPOComputerLocalGroupMapping" nocase ascii wide
$string333_empire_offensive_tool_keyword = "Get-DomainGPOUserLocalGroupMapping" nocase ascii wide
$string334_empire_offensive_tool_keyword = "Get-DomainManagedSecurityGroup" nocase ascii wide
$string335_empire_offensive_tool_keyword = "Get-DomainObjectACL -" nocase ascii wide
$string336_empire_offensive_tool_keyword = "Get-DomainSearcher" nocase ascii wide
$string337_empire_offensive_tool_keyword = "Get-DomainSpn" nocase ascii wide
$string338_empire_offensive_tool_keyword = "Get-DomainSPNTicket" nocase ascii wide
$string339_empire_offensive_tool_keyword = "Get-FireFoxHistory" nocase ascii wide
$string340_empire_offensive_tool_keyword = "Get-FoxDump " nocase ascii wide
$string341_empire_offensive_tool_keyword = "Get-FoxDump" nocase ascii wide
$string342_empire_offensive_tool_keyword = /Get\-FoxDump\.ps1/ nocase ascii wide
$string343_empire_offensive_tool_keyword = "Get-GPPInnerFields" nocase ascii wide
$string344_empire_offensive_tool_keyword = "Get-GPPPassword" nocase ascii wide
$string345_empire_offensive_tool_keyword = /Get\-GPPPassword\.ps1/ nocase ascii wide
$string346_empire_offensive_tool_keyword = "Get-ImageNtHeaders" nocase ascii wide
$string347_empire_offensive_tool_keyword = /Get\-IndexedItem\.ps1/ nocase ascii wide
$string348_empire_offensive_tool_keyword = "Get-InternetExplorerBookmarks" nocase ascii wide
$string349_empire_offensive_tool_keyword = "Get-InternetExplorerHistory" nocase ascii wide
$string350_empire_offensive_tool_keyword = "Get-KeePassconfig" nocase ascii wide
$string351_empire_offensive_tool_keyword = "Get-KeePassDatabaseKey" nocase ascii wide
$string352_empire_offensive_tool_keyword = "Get-KeePassINIFields" nocase ascii wide
$string353_empire_offensive_tool_keyword = "Get-KeePassXMLFields" nocase ascii wide
$string354_empire_offensive_tool_keyword = "Get-KerberosServiceTicket" nocase ascii wide
$string355_empire_offensive_tool_keyword = /Get\-KerberosServiceTicket\.ps1/ nocase ascii wide
$string356_empire_offensive_tool_keyword = "Get-Keystrokes" nocase ascii wide
$string357_empire_offensive_tool_keyword = /Get\-Keystrokes\.ps1/ nocase ascii wide
$string358_empire_offensive_tool_keyword = "Get-Killdate" nocase ascii wide
$string359_empire_offensive_tool_keyword = "Get-LAPSPasswords" nocase ascii wide
$string360_empire_offensive_tool_keyword = /Get\-LAPSPasswords\.ps1/ nocase ascii wide
$string361_empire_offensive_tool_keyword = "Get-LastLoggedon -" nocase ascii wide
$string362_empire_offensive_tool_keyword = "Get-LoggedOnLocal -" nocase ascii wide
$string363_empire_offensive_tool_keyword = "Get-LsaSecret " nocase ascii wide
$string364_empire_offensive_tool_keyword = "Get-ModifiableRegistryAutoRun" nocase ascii wide
$string365_empire_offensive_tool_keyword = "Get-ModifiableScheduledTaskFile" nocase ascii wide
$string366_empire_offensive_tool_keyword = "Get-NetComputer -Unconstrainuser" nocase ascii wide
$string367_empire_offensive_tool_keyword = "Get-NetFileServer" nocase ascii wide
$string368_empire_offensive_tool_keyword = "Get-NetForestDomain" nocase ascii wide
$string369_empire_offensive_tool_keyword = "Get-NetLoggedon -" nocase ascii wide
$string370_empire_offensive_tool_keyword = "Get-NetRDPSession -" nocase ascii wide
$string371_empire_offensive_tool_keyword = "Get-NetUser -SPN" nocase ascii wide
$string372_empire_offensive_tool_keyword = "Get-NetUser -UACFilter NOT_ACCOUNTDISABLE" nocase ascii wide
$string373_empire_offensive_tool_keyword = "Get-NTLMLocalPasswordHashes" nocase ascii wide
$string374_empire_offensive_tool_keyword = "Get-PacketNetBIOSSessionService" nocase ascii wide
$string375_empire_offensive_tool_keyword = "Get-PacketNTLMSSPAuth" nocase ascii wide
$string376_empire_offensive_tool_keyword = "Get-PacketNTLMSSPNegotiate" nocase ascii wide
$string377_empire_offensive_tool_keyword = "Get-PacketRPCBind" nocase ascii wide
$string378_empire_offensive_tool_keyword = "Get-PacketRPCRequest" nocase ascii wide
$string379_empire_offensive_tool_keyword = "Get-PacketSMB" nocase ascii wide
$string380_empire_offensive_tool_keyword = "Get-PEBasicInfo" nocase ascii wide
$string381_empire_offensive_tool_keyword = "Get-PSADForestInfo " nocase ascii wide
$string382_empire_offensive_tool_keyword = "Get-PSADForestKRBTGTInfo " nocase ascii wide
$string383_empire_offensive_tool_keyword = "Get-RegAlwaysInstallElevated" nocase ascii wide
$string384_empire_offensive_tool_keyword = "Get-RegAutoLogon" nocase ascii wide
$string385_empire_offensive_tool_keyword = "Get-RegistryAlwaysInstallElevated" nocase ascii wide
$string386_empire_offensive_tool_keyword = "Get-RegistryAutoLogon" nocase ascii wide
$string387_empire_offensive_tool_keyword = "Get-RickAstley" nocase ascii wide
$string388_empire_offensive_tool_keyword = /Get\-RickAstley\.ps1/ nocase ascii wide
$string389_empire_offensive_tool_keyword = "Get-RubeusForgeryArgs" nocase ascii wide
$string390_empire_offensive_tool_keyword = /Get\-Screenshot\.ps1/ nocase ascii wide
$string391_empire_offensive_tool_keyword = /Get\-SecurityPackages\.ps1/ nocase ascii wide
$string392_empire_offensive_tool_keyword = "Get-ServiceUnquoted" nocase ascii wide
$string393_empire_offensive_tool_keyword = "Get-SharpChromium" nocase ascii wide
$string394_empire_offensive_tool_keyword = /Get\-SharpChromium\.ps1/ nocase ascii wide
$string395_empire_offensive_tool_keyword = "Get-SitelistFields" nocase ascii wide
$string396_empire_offensive_tool_keyword = "Get-SiteListPassword" nocase ascii wide
$string397_empire_offensive_tool_keyword = /Get\-SiteListPassword\.ps1/ nocase ascii wide
$string398_empire_offensive_tool_keyword = /Get\-SPN\.ps1/ nocase ascii wide
$string399_empire_offensive_tool_keyword = "Get-SQLInstanceDomain" nocase ascii wide
$string400_empire_offensive_tool_keyword = /Get\-SQLInstanceDomain\.ps1/ nocase ascii wide
$string401_empire_offensive_tool_keyword = /Get\-SQLQuery\.ps1/ nocase ascii wide
$string402_empire_offensive_tool_keyword = "Get-SQLServerLoginDefaultPw" nocase ascii wide
$string403_empire_offensive_tool_keyword = "Get-SQLSysadminCheck" nocase ascii wide
$string404_empire_offensive_tool_keyword = /Get\-System\.ps1/ nocase ascii wide
$string405_empire_offensive_tool_keyword = /Get\-SystemDNSServer\.ps1/ nocase ascii wide
$string406_empire_offensive_tool_keyword = "Get-SystemNamedPipe" nocase ascii wide
$string407_empire_offensive_tool_keyword = /Get\-TimedScreenshot\.ps1/ nocase ascii wide
$string408_empire_offensive_tool_keyword = "Get-UniqueTokens" nocase ascii wide
$string409_empire_offensive_tool_keyword = "Get-USBKeystrokes" nocase ascii wide
$string410_empire_offensive_tool_keyword = "Get-UserBadPwdCount" nocase ascii wide
$string411_empire_offensive_tool_keyword = "Get-VaultCredential" nocase ascii wide
$string412_empire_offensive_tool_keyword = /Get\-VaultCredential\.ps1/ nocase ascii wide
$string413_empire_offensive_tool_keyword = "Get-VulnAutoRun" nocase ascii wide
$string414_empire_offensive_tool_keyword = "Get-VulnSchTask" nocase ascii wide
$string415_empire_offensive_tool_keyword = /Get\-WinUpdates\.ps1/ nocase ascii wide
$string416_empire_offensive_tool_keyword = "Get-WMIRegCachedRDPConnection" nocase ascii wide
$string417_empire_offensive_tool_keyword = "Get-WMIRegLastLoggedOn" nocase ascii wide
$string418_empire_offensive_tool_keyword = "Get-WMIRegMountedDrive" nocase ascii wide
$string419_empire_offensive_tool_keyword = "Get-WorkingHours" nocase ascii wide
$string420_empire_offensive_tool_keyword = "H4sIAAAAAAAEAIy5BVyTbdQ4PDbYYJSju2N0h5TSndJINyKD0RKKdIOgNIiSChIiYUurgIQoiICAlAJSiojgd9" nocase ascii wide
$string421_empire_offensive_tool_keyword = "Honey hash" nocase ascii wide
$string422_empire_offensive_tool_keyword = /http.{0,100}\/127\.0\.0\.1.{0,100}\:1337/ nocase ascii wide
$string423_empire_offensive_tool_keyword = /http.{0,100}\/localhost.{0,100}\:1337/ nocase ascii wide
$string424_empire_offensive_tool_keyword = /http\:\/\/127\.0\.0\.1\:8080\/invoker\/JMXInvokerServlet/ nocase ascii wide
$string425_empire_offensive_tool_keyword = /http\:\/\/localhost\/stager\.php/ nocase ascii wide
$string426_empire_offensive_tool_keyword = "http://localhost:80/bcsjngnk" nocase ascii wide
$string427_empire_offensive_tool_keyword = /http_malleable\.py/ nocase ascii wide
$string428_empire_offensive_tool_keyword = /HTTP\-Login\.ps1/ nocase ascii wide
$string429_empire_offensive_tool_keyword = "ImportDll::GetAsyncKeyState" nocase ascii wide
$string430_empire_offensive_tool_keyword = "Import-DllImports" nocase ascii wide
$string431_empire_offensive_tool_keyword = "Import-DllInRemoteProcess" nocase ascii wide
$string432_empire_offensive_tool_keyword = "Import-PhishWinLib" nocase ascii wide
$string433_empire_offensive_tool_keyword = "Inject-BypassStuff " nocase ascii wide
$string434_empire_offensive_tool_keyword = "Inject-BypassStuff" nocase ascii wide
$string435_empire_offensive_tool_keyword = "injected into LSASS" nocase ascii wide
$string436_empire_offensive_tool_keyword = /Injection.{0,100}\s\-ProcName\slsass/ nocase ascii wide
$string437_empire_offensive_tool_keyword = "Inject-LocalShellcode" nocase ascii wide
$string438_empire_offensive_tool_keyword = "Inject-NetRipper" nocase ascii wide
$string439_empire_offensive_tool_keyword = "Inject-RemoteShellcode " nocase ascii wide
$string440_empire_offensive_tool_keyword = "Inject-RemoteShellcode" nocase ascii wide
$string441_empire_offensive_tool_keyword = "install powershell-empire" nocase ascii wide
$string442_empire_offensive_tool_keyword = "Install-ServiceBinary" nocase ascii wide
$string443_empire_offensive_tool_keyword = /Install\-SSP\s\-Path.{0,100}\.dll/ nocase ascii wide
$string444_empire_offensive_tool_keyword = /Install\-SSP\.ps1/ nocase ascii wide
$string445_empire_offensive_tool_keyword = "-Inveigh " nocase ascii wide
$string446_empire_offensive_tool_keyword = "Inveigh Relay" nocase ascii wide
$string447_empire_offensive_tool_keyword = "inveigh_version" nocase ascii wide
$string448_empire_offensive_tool_keyword = "-InveighRelay " nocase ascii wide
$string449_empire_offensive_tool_keyword = "invoke obfuscation" nocase ascii wide
$string450_empire_offensive_tool_keyword = "Invoke-ARPScan" nocase ascii wide
$string451_empire_offensive_tool_keyword = /Invoke\-ARPScan\.ps1/ nocase ascii wide
$string452_empire_offensive_tool_keyword = /Invoke\-Assembly\.ps1/ nocase ascii wide
$string453_empire_offensive_tool_keyword = "Invoke-BackdoorLNK" nocase ascii wide
$string454_empire_offensive_tool_keyword = /Invoke\-BackdoorLNK\.ps1/ nocase ascii wide
$string455_empire_offensive_tool_keyword = "Invoke-BloodHound" nocase ascii wide
$string456_empire_offensive_tool_keyword = /Invoke\-Boolang\.ps1/ nocase ascii wide
$string457_empire_offensive_tool_keyword = /Invoke\-BSOD\.ps1/ nocase ascii wide
$string458_empire_offensive_tool_keyword = "Invoke-BypassUAC -Command " nocase ascii wide
$string459_empire_offensive_tool_keyword = "Invoke-BypassUAC" nocase ascii wide
$string460_empire_offensive_tool_keyword = /Invoke\-BypassUAC\.ps1/ nocase ascii wide
$string461_empire_offensive_tool_keyword = "Invoke-BypassUACTokenManipulation" nocase ascii wide
$string462_empire_offensive_tool_keyword = "Invoke-CallbackIEX" nocase ascii wide
$string463_empire_offensive_tool_keyword = "Invoke-ClearScript" nocase ascii wide
$string464_empire_offensive_tool_keyword = /Invoke\-ClearScript\.ps1/ nocase ascii wide
$string465_empire_offensive_tool_keyword = "Invoke-ClipboardMonitor" nocase ascii wide
$string466_empire_offensive_tool_keyword = "Invoke-CopyFile" nocase ascii wide
$string467_empire_offensive_tool_keyword = "Invoke-CredentialInjection" nocase ascii wide
$string468_empire_offensive_tool_keyword = "Invoke-CredentialInjection" nocase ascii wide
$string469_empire_offensive_tool_keyword = "Invoke-CredentialPhisher" nocase ascii wide
$string470_empire_offensive_tool_keyword = "Invoke-CredentialPhisher" nocase ascii wide
$string471_empire_offensive_tool_keyword = /Invoke\-CredentialPhisher\.ps1/ nocase ascii wide
$string472_empire_offensive_tool_keyword = /Invoke\-DCOM\.ps1/ nocase ascii wide
$string473_empire_offensive_tool_keyword = "Invoke-DCSync " nocase ascii wide
$string474_empire_offensive_tool_keyword = "Invoke-DCSync" nocase ascii wide
$string475_empire_offensive_tool_keyword = "Invoke-DeadUserBackdoor" nocase ascii wide
$string476_empire_offensive_tool_keyword = "Invoke-DisableMachineAcctChange" nocase ascii wide
$string477_empire_offensive_tool_keyword = "Invoke-DllEncode" nocase ascii wide
$string478_empire_offensive_tool_keyword = "Invoke-DllHijackingCheck" nocase ascii wide
$string479_empire_offensive_tool_keyword = "Invoke-DllInjection" nocase ascii wide
$string480_empire_offensive_tool_keyword = /Invoke\-DllInjection\.ps1/ nocase ascii wide
$string481_empire_offensive_tool_keyword = "Invoke-DomainPasswordSpray" nocase ascii wide
$string482_empire_offensive_tool_keyword = "Invoke-DownloadFile " nocase ascii wide
$string483_empire_offensive_tool_keyword = /Invoke\-DownloadFile\.ps1/ nocase ascii wide
$string484_empire_offensive_tool_keyword = "Invoke-DropboxUpload" nocase ascii wide
$string485_empire_offensive_tool_keyword = "Invoke-EgressCheck" nocase ascii wide
$string486_empire_offensive_tool_keyword = /Invoke\-EgressCheck\.ps1/ nocase ascii wide
$string487_empire_offensive_tool_keyword = "Invoke-Empire -Servers" nocase ascii wide
$string488_empire_offensive_tool_keyword = "Invoke-Empire" nocase ascii wide
$string489_empire_offensive_tool_keyword = "Invoke-EnumerateLocalAdmin" nocase ascii wide
$string490_empire_offensive_tool_keyword = "Invoke-EnvBypass -Command " nocase ascii wide
$string491_empire_offensive_tool_keyword = "Invoke-EnvBypass" nocase ascii wide
$string492_empire_offensive_tool_keyword = /Invoke\-EnvBypass\.ps1/ nocase ascii wide
$string493_empire_offensive_tool_keyword = "Invoke-EternalBlue" nocase ascii wide
$string494_empire_offensive_tool_keyword = "Invoke-EternalBlue" nocase ascii wide
$string495_empire_offensive_tool_keyword = "Invoke-EventVwrBypass" nocase ascii wide
$string496_empire_offensive_tool_keyword = /Invoke\-EventVwrBypass\.ps1/ nocase ascii wide
$string497_empire_offensive_tool_keyword = "Invoke-ExecuteMSBuild" nocase ascii wide
$string498_empire_offensive_tool_keyword = /Invoke\-ExecuteMSBuild\.ps1/ nocase ascii wide
$string499_empire_offensive_tool_keyword = "Invoke-ExfilDataToGitHub" nocase ascii wide
$string500_empire_offensive_tool_keyword = "Invoke-FindDLLHijack" nocase ascii wide
$string501_empire_offensive_tool_keyword = "Invoke-FindPathHijack" nocase ascii wide
$string502_empire_offensive_tool_keyword = "Invoke-FodHelperBypass" nocase ascii wide
$string503_empire_offensive_tool_keyword = "Invoke-FodHelperBypass" nocase ascii wide
$string504_empire_offensive_tool_keyword = /Invoke\-FodHelperBypass\.ps1/ nocase ascii wide
$string505_empire_offensive_tool_keyword = "Invoke-HostRecon" nocase ascii wide
$string506_empire_offensive_tool_keyword = "Invoke-ImpersonateUser" nocase ascii wide
$string507_empire_offensive_tool_keyword = "Invoke-Inveigh" nocase ascii wide
$string508_empire_offensive_tool_keyword = /Invoke\-Inveigh\.ps1/ nocase ascii wide
$string509_empire_offensive_tool_keyword = /Invoke\-InveighRelay\.ps1/ nocase ascii wide
$string510_empire_offensive_tool_keyword = "Invoke-IronPython" nocase ascii wide
$string511_empire_offensive_tool_keyword = /Invoke\-IronPython\.ps1/ nocase ascii wide
$string512_empire_offensive_tool_keyword = "Invoke-IronPython3" nocase ascii wide
$string513_empire_offensive_tool_keyword = /Invoke\-IronPython3\.ps1/ nocase ascii wide
$string514_empire_offensive_tool_keyword = "Invoke-KeeThief" nocase ascii wide
$string515_empire_offensive_tool_keyword = "Invoke-Kerberoast" nocase ascii wide
$string516_empire_offensive_tool_keyword = "Invoke-LockWorkStation" nocase ascii wide
$string517_empire_offensive_tool_keyword = "Invoke-MailSearch" nocase ascii wide
$string518_empire_offensive_tool_keyword = "Invoke-MetasploitPayload" nocase ascii wide
$string519_empire_offensive_tool_keyword = /Invoke\-MetasploitPayload\.ps1/ nocase ascii wide
$string520_empire_offensive_tool_keyword = "Invoke-Mimikatz -Command " nocase ascii wide
$string521_empire_offensive_tool_keyword = "Invoke-MS16032" nocase ascii wide
$string522_empire_offensive_tool_keyword = /Invoke\-MS16032\.ps1/ nocase ascii wide
$string523_empire_offensive_tool_keyword = /Invoke\-MS16\-032\.ps1/ nocase ascii wide
$string524_empire_offensive_tool_keyword = "Invoke-MS16135" nocase ascii wide
$string525_empire_offensive_tool_keyword = "Invoke-NetRipper" nocase ascii wide
$string526_empire_offensive_tool_keyword = /Invoke\-NetRipper\.ps1/ nocase ascii wide
$string527_empire_offensive_tool_keyword = "Invoke-NinjaCopy" nocase ascii wide
$string528_empire_offensive_tool_keyword = /Invoke\-NinjaCopy\.ps1/ nocase ascii wide
$string529_empire_offensive_tool_keyword = "Invoke-NTLMExtract" nocase ascii wide
$string530_empire_offensive_tool_keyword = "Invoke-NTLMExtract" nocase ascii wide
$string531_empire_offensive_tool_keyword = /Invoke\-NTLMExtract\.ps1/ nocase ascii wide
$string532_empire_offensive_tool_keyword = /Invoke\-Ntsd\.ps1/ nocase ascii wide
$string533_empire_offensive_tool_keyword = "Invoke-PacketCapture" nocase ascii wide
$string534_empire_offensive_tool_keyword = "Invoke-PacketKnock" nocase ascii wide
$string535_empire_offensive_tool_keyword = "Invoke-Paranoia" nocase ascii wide
$string536_empire_offensive_tool_keyword = /Invoke\-Paranoia\.ps1/ nocase ascii wide
$string537_empire_offensive_tool_keyword = "Invoke-PatchDll" nocase ascii wide
$string538_empire_offensive_tool_keyword = "Invoke-PatchDll" nocase ascii wide
$string539_empire_offensive_tool_keyword = "Invoke-PhishingLNK" nocase ascii wide
$string540_empire_offensive_tool_keyword = "Invoke-PhishingLNK" nocase ascii wide
$string541_empire_offensive_tool_keyword = /Invoke\-PhishingLNK\.ps1/ nocase ascii wide
$string542_empire_offensive_tool_keyword = "Invoke-PortBind" nocase ascii wide
$string543_empire_offensive_tool_keyword = "Invoke-PortFwd " nocase ascii wide
$string544_empire_offensive_tool_keyword = /Invoke\-PortFwd\.ps1/ nocase ascii wide
$string545_empire_offensive_tool_keyword = "Invoke-Portscan" nocase ascii wide
$string546_empire_offensive_tool_keyword = /Invoke\-Portscan\.ps1/ nocase ascii wide
$string547_empire_offensive_tool_keyword = "Invoke-PostExfil" nocase ascii wide
$string548_empire_offensive_tool_keyword = "Invoke-PowerDump" nocase ascii wide
$string549_empire_offensive_tool_keyword = /Invoke\-PowerDump\.ps1/ nocase ascii wide
$string550_empire_offensive_tool_keyword = /Invoke\-PrintDemon\.ps1/ nocase ascii wide
$string551_empire_offensive_tool_keyword = /Invoke\-Printnightmare\.ps1/ nocase ascii wide
$string552_empire_offensive_tool_keyword = "Invoke-ProcessKiller" nocase ascii wide
$string553_empire_offensive_tool_keyword = "Invoke-PsExec" nocase ascii wide
$string554_empire_offensive_tool_keyword = /Invoke\-PsExec\.ps1/ nocase ascii wide
$string555_empire_offensive_tool_keyword = "Invoke-PsExecCmd" nocase ascii wide
$string556_empire_offensive_tool_keyword = "Invoke-PSInject" nocase ascii wide
$string557_empire_offensive_tool_keyword = /Invoke\-PSInject\.ps1/ nocase ascii wide
$string558_empire_offensive_tool_keyword = "Invoke-PSRemoting" nocase ascii wide
$string559_empire_offensive_tool_keyword = "Invoke-ReflectivePEInjection" nocase ascii wide
$string560_empire_offensive_tool_keyword = "Invoke-ReverseDNSLookup" nocase ascii wide
$string561_empire_offensive_tool_keyword = /Invoke\-ReverseDNSLookup\.ps1/ nocase ascii wide
$string562_empire_offensive_tool_keyword = "Invoke-RickASCII" nocase ascii wide
$string563_empire_offensive_tool_keyword = /Invoke\-RIDHijacking\.ps1/ nocase ascii wide
$string564_empire_offensive_tool_keyword = /Invoke\-SauronEye\.ps1/ nocase ascii wide
$string565_empire_offensive_tool_keyword = "Invoke-SccmCacheFolderVulnCheck" nocase ascii wide
$string566_empire_offensive_tool_keyword = "Invoke-Schtasks" nocase ascii wide
$string567_empire_offensive_tool_keyword = "Invoke-SDCLTBypass" nocase ascii wide
$string568_empire_offensive_tool_keyword = /Invoke\-SDCLTBypass\.ps1/ nocase ascii wide
$string569_empire_offensive_tool_keyword = "Invoke-SearchGAL" nocase ascii wide
$string570_empire_offensive_tool_keyword = "Invoke-ServiceAbuse" nocase ascii wide
$string571_empire_offensive_tool_keyword = "Invoke-ServiceCMD" nocase ascii wide
$string572_empire_offensive_tool_keyword = "Invoke-ServiceDisable" nocase ascii wide
$string573_empire_offensive_tool_keyword = "Invoke-ServiceStart" nocase ascii wide
$string574_empire_offensive_tool_keyword = "Invoke-ServiceStop" nocase ascii wide
$string575_empire_offensive_tool_keyword = "Invoke-ServiceUserAdd" nocase ascii wide
$string576_empire_offensive_tool_keyword = "Invoke-SessionGopher" nocase ascii wide
$string577_empire_offensive_tool_keyword = /Invoke\-SessionGopher\.ps1/ nocase ascii wide
$string578_empire_offensive_tool_keyword = "Invoke-SharpChiselClient" nocase ascii wide
$string579_empire_offensive_tool_keyword = /Invoke\-SharpChiselClient\.ps1/ nocase ascii wide
$string580_empire_offensive_tool_keyword = /Invoke\-SharpLoginPrompt\.ps1/ nocase ascii wide
$string581_empire_offensive_tool_keyword = "Invoke-SharpSecDump " nocase ascii wide
$string582_empire_offensive_tool_keyword = /Invoke\-SharpSecDump\.ps1/ nocase ascii wide
$string583_empire_offensive_tool_keyword = /Invoke\-Shellcode\.ps1/ nocase ascii wide
$string584_empire_offensive_tool_keyword = "Invoke-ShellcodeMSIL" nocase ascii wide
$string585_empire_offensive_tool_keyword = /Invoke\-ShellcodeMSIL\.ps1/ nocase ascii wide
$string586_empire_offensive_tool_keyword = "Invoke-ShellCommand" nocase ascii wide
$string587_empire_offensive_tool_keyword = "Invoke-SMBAutoBrute" nocase ascii wide
$string588_empire_offensive_tool_keyword = "Invoke-SMBAutoBrute" nocase ascii wide
$string589_empire_offensive_tool_keyword = /Invoke\-SMBAutoBrute\.ps1/ nocase ascii wide
$string590_empire_offensive_tool_keyword = /Invoke\-SMBExec\.ps1/ nocase ascii wide
$string591_empire_offensive_tool_keyword = /Invoke\-SMBLogin\.ps1/ nocase ascii wide
$string592_empire_offensive_tool_keyword = "Invoke-SMBScanner" nocase ascii wide
$string593_empire_offensive_tool_keyword = "Invoke-SmbScanner" nocase ascii wide
$string594_empire_offensive_tool_keyword = /Invoke\-SmbScanner\.ps1/ nocase ascii wide
$string595_empire_offensive_tool_keyword = "Invoke-SocksProxy" nocase ascii wide
$string596_empire_offensive_tool_keyword = "Invoke-SpawnAs" nocase ascii wide
$string597_empire_offensive_tool_keyword = /Invoke\-SpoolSample\.ps1/ nocase ascii wide
$string598_empire_offensive_tool_keyword = "Invoke-SQLOSCMD" nocase ascii wide
$string599_empire_offensive_tool_keyword = /Invoke\-SQLOSCmd\.ps1/ nocase ascii wide
$string600_empire_offensive_tool_keyword = "Invoke-Ssharp " nocase ascii wide
$string601_empire_offensive_tool_keyword = /Invoke\-SSharp\.ps1/ nocase ascii wide
$string602_empire_offensive_tool_keyword = /Invoke\-SSHCommand\.ps1/ nocase ascii wide
$string603_empire_offensive_tool_keyword = "Invoke-SweetPotato" nocase ascii wide
$string604_empire_offensive_tool_keyword = /Invoke\-SweetPotato\.ps1/ nocase ascii wide
$string605_empire_offensive_tool_keyword = "Invoke-Tater " nocase ascii wide
$string606_empire_offensive_tool_keyword = /Invoke\-Tater\./ nocase ascii wide
$string607_empire_offensive_tool_keyword = /Invoke\-Tater\.ps1/ nocase ascii wide
$string608_empire_offensive_tool_keyword = /Invoke\-Tater\.ps1/ nocase ascii wide
$string609_empire_offensive_tool_keyword = "Invoke-ThreadedFunction" nocase ascii wide
$string610_empire_offensive_tool_keyword = "Invoke-Thunderstruck" nocase ascii wide
$string611_empire_offensive_tool_keyword = "Invoke-TokenManipulation" nocase ascii wide
$string612_empire_offensive_tool_keyword = /Invoke\-TokenManipulation\.ps1/ nocase ascii wide
$string613_empire_offensive_tool_keyword = "Invoke-UserHunter" nocase ascii wide
$string614_empire_offensive_tool_keyword = "Invoke-UserImpersonation" nocase ascii wide
$string615_empire_offensive_tool_keyword = "Invoke-VeeamGetCreds" nocase ascii wide
$string616_empire_offensive_tool_keyword = "Invoke-Vnc" nocase ascii wide
$string617_empire_offensive_tool_keyword = /Invoke\-Vnc\.ps1/ nocase ascii wide
$string618_empire_offensive_tool_keyword = /Invoke\-VoiceTroll\.ps1/ nocase ascii wide
$string619_empire_offensive_tool_keyword = "Invoke-Watson" nocase ascii wide
$string620_empire_offensive_tool_keyword = /Invoke\-Watson\.ps1/ nocase ascii wide
$string621_empire_offensive_tool_keyword = "Invoke-WdigestDowngrade" nocase ascii wide
$string622_empire_offensive_tool_keyword = /Invoke\-WindowsEnum\.ps1/ nocase ascii wide
$string623_empire_offensive_tool_keyword = "Invoke-WinEnum" nocase ascii wide
$string624_empire_offensive_tool_keyword = /Invoke\-WinEnum\.ps1/ nocase ascii wide
$string625_empire_offensive_tool_keyword = /Invoke\-winPEAS\.ps1/ nocase ascii wide
$string626_empire_offensive_tool_keyword = /Invoke\-WireTap\.ps1/ nocase ascii wide
$string627_empire_offensive_tool_keyword = "Invoke-WLMDR" nocase ascii wide
$string628_empire_offensive_tool_keyword = "Invoke-WMIDebugger" nocase ascii wide
$string629_empire_offensive_tool_keyword = "Invoke-WScriptBypassUAC" nocase ascii wide
$string630_empire_offensive_tool_keyword = /Invoke\-WScriptBypassUAC\.ps1/ nocase ascii wide
$string631_empire_offensive_tool_keyword = "Invoke-WscriptElevate" nocase ascii wide
$string632_empire_offensive_tool_keyword = "Invoke-WsusConfigCheck" nocase ascii wide
$string633_empire_offensive_tool_keyword = /Invoke\-ZeroLogon\.ps1/ nocase ascii wide
$string634_empire_offensive_tool_keyword = /KeePassConfig\.ps1/ nocase ascii wide
$string635_empire_offensive_tool_keyword = "-KeePassConfigTrigger" nocase ascii wide
$string636_empire_offensive_tool_keyword = /KeeThief\./ nocase ascii wide
$string637_empire_offensive_tool_keyword = /KeeThief\.ps1/ nocase ascii wide
$string638_empire_offensive_tool_keyword = "keyword_obfuscation" nocase ascii wide
$string639_empire_offensive_tool_keyword = "Kicking off download cradle in a new process" nocase ascii wide
$string640_empire_offensive_tool_keyword = "Killed running eventvwr" nocase ascii wide
$string641_empire_offensive_tool_keyword = "Killed running sdclt" nocase ascii wide
$string642_empire_offensive_tool_keyword = "l33th4x0r=cm91dGluZyBwYWNrZXQ=" nocase ascii wide
$string643_empire_offensive_tool_keyword = "Launch Empire CLI" nocase ascii wide
$string644_empire_offensive_tool_keyword = "Launch Empire Server" nocase ascii wide
$string645_empire_offensive_tool_keyword = "ListMetasploitPayloads" nocase ascii wide
$string646_empire_offensive_tool_keyword = "LLMNRSpoofer" nocase ascii wide
$string647_empire_offensive_tool_keyword = "LLMNRSpoofer" nocase ascii wide
$string648_empire_offensive_tool_keyword = "local:Get-DecryptedCpassword" nocase ascii wide
$string649_empire_offensive_tool_keyword = "Local:Get-DecryptedSitelistPassword" nocase ascii wide
$string650_empire_offensive_tool_keyword = "Local:Get-DelegateType" nocase ascii wide
$string651_empire_offensive_tool_keyword = "Local:Get-KeePassXMLFields" nocase ascii wide
$string652_empire_offensive_tool_keyword = "Local:Get-PEArchitecture" nocase ascii wide
$string653_empire_offensive_tool_keyword = "Local:Get-ProcAddress" nocase ascii wide
$string654_empire_offensive_tool_keyword = "Local:Invoke-PatchDll" nocase ascii wide
$string655_empire_offensive_tool_keyword = "Local:Invoke-WscriptElevate" nocase ascii wide
$string656_empire_offensive_tool_keyword = "Local:Invoke-WscriptTrigger" nocase ascii wide
$string657_empire_offensive_tool_keyword = "Local:Remove-ADS" nocase ascii wide
$string658_empire_offensive_tool_keyword = "Local:Write-HijackDll" nocase ascii wide
$string659_empire_offensive_tool_keyword = "lsadump::dcsync" nocase ascii wide
$string660_empire_offensive_tool_keyword = "make_kernel_shellcode" nocase ascii wide
$string661_empire_offensive_tool_keyword = "make_kernel_user_payload" nocase ascii wide
$string662_empire_offensive_tool_keyword = "make_smb1_anonymous_login_packet" nocase ascii wide
$string663_empire_offensive_tool_keyword = "make_smb1_echo_packet" nocase ascii wide
$string664_empire_offensive_tool_keyword = "make_smb1_free_hole_session_packet" nocase ascii wide
$string665_empire_offensive_tool_keyword = "make_smb1_nt_trans_packet" nocase ascii wide
$string666_empire_offensive_tool_keyword = "make_smb1_trans2_explo" nocase ascii wide
$string667_empire_offensive_tool_keyword = "make_smb2_payload_body_packet" nocase ascii wide
$string668_empire_offensive_tool_keyword = "make_smb2_payload_headers_packet" nocase ascii wide
$string669_empire_offensive_tool_keyword = /MalleableProfiles\.vue/ nocase ascii wide
$string670_empire_offensive_tool_keyword = "mDNSSpoofer" nocase ascii wide
$string671_empire_offensive_tool_keyword = /MetasploitPayload\.ps1/ nocase ascii wide
$string672_empire_offensive_tool_keyword = /MiniEmpireDLL\.dll/ nocase ascii wide
$string673_empire_offensive_tool_keyword = "NBNSBruteForceHost" nocase ascii wide
$string674_empire_offensive_tool_keyword = "NBNSBruteForcePause" nocase ascii wide
$string675_empire_offensive_tool_keyword = "NBNSBruteForceSpoofer" nocase ascii wide
$string676_empire_offensive_tool_keyword = "NBNSBruteForceSpoofer" nocase ascii wide
$string677_empire_offensive_tool_keyword = "NBNSBruteForceTarget" nocase ascii wide
$string678_empire_offensive_tool_keyword = "NBNSSpoofer" nocase ascii wide
$string679_empire_offensive_tool_keyword = "net user Tater " nocase ascii wide
$string680_empire_offensive_tool_keyword = "New-ElevatedPersistenceOption" nocase ascii wide
$string681_empire_offensive_tool_keyword = "New-HoneyHash" nocase ascii wide
$string682_empire_offensive_tool_keyword = /New\-HoneyHash\.ps1/ nocase ascii wide
$string683_empire_offensive_tool_keyword = "New-InMemoryModule -ModuleName Win32" nocase ascii wide
$string684_empire_offensive_tool_keyword = "New-InMemoryModule" nocase ascii wide
$string685_empire_offensive_tool_keyword = "New-RoutingPacket" nocase ascii wide
$string686_empire_offensive_tool_keyword = "New-UserPersistenceOption" nocase ascii wide
$string687_empire_offensive_tool_keyword = "NTLMChallengeBase64" nocase ascii wide
$string688_empire_offensive_tool_keyword = /NTLMExtract\.ps1/ nocase ascii wide
$string689_empire_offensive_tool_keyword = "obfuscate_command" nocase ascii wide
$string690_empire_offensive_tool_keyword = "obfuscated_module_source/" nocase ascii wide
$string691_empire_offensive_tool_keyword = "Out-Minidump " nocase ascii wide
$string692_empire_offensive_tool_keyword = /Out\-Minidump\.ps1/ nocase ascii wide
$string693_empire_offensive_tool_keyword = /Persistence\.psm1/ nocase ascii wide
$string694_empire_offensive_tool_keyword = "persistence/userland/backdoor_lnk" nocase ascii wide
$string695_empire_offensive_tool_keyword = /port_forward_pivot\.py/ nocase ascii wide
$string696_empire_offensive_tool_keyword = /PowerBreach\.ps1/ nocase ascii wide
$string697_empire_offensive_tool_keyword = "powershell_code_execution_invoke_assembly" nocase ascii wide
$string698_empire_offensive_tool_keyword = "powershell_collection_keylogger" nocase ascii wide
$string699_empire_offensive_tool_keyword = "powershell_collection_screenshot" nocase ascii wide
$string700_empire_offensive_tool_keyword = "powershell_credentials_tokens" nocase ascii wide
$string701_empire_offensive_tool_keyword = "powershell_management_psinject" nocase ascii wide
$string702_empire_offensive_tool_keyword = "powershell_management_spawn" nocase ascii wide
$string703_empire_offensive_tool_keyword = "powershell_privesc_bypassuac_eventvwr" nocase ascii wide
$string704_empire_offensive_tool_keyword = "powershell_privesc_sherlock" nocase ascii wide
$string705_empire_offensive_tool_keyword = "PowerShellEmpire" nocase ascii wide
$string706_empire_offensive_tool_keyword = /PowerUp\.ps1/ nocase ascii wide
$string707_empire_offensive_tool_keyword = /PowerUpSQL\.ps1/ nocase ascii wide
$string708_empire_offensive_tool_keyword = /powerview\.ps1/ nocase ascii wide
$string709_empire_offensive_tool_keyword = "ProcessFileZillaFile" nocase ascii wide
$string710_empire_offensive_tool_keyword = /\-ProcessID\s.{0,100}\s\-Dll\s.{0,100}\s\-Module\s/ nocase ascii wide
$string711_empire_offensive_tool_keyword = "ProcessPPKFile" nocase ascii wide
$string712_empire_offensive_tool_keyword = "ProcessPuTTYLocal" nocase ascii wide
$string713_empire_offensive_tool_keyword = "ProcessRDPFile" nocase ascii wide
$string714_empire_offensive_tool_keyword = "ProcessRDPLocal" nocase ascii wide
$string715_empire_offensive_tool_keyword = "ProcessSuperPuTTYFile" nocase ascii wide
$string716_empire_offensive_tool_keyword = "Process-TaskingPackets" nocase ascii wide
$string717_empire_offensive_tool_keyword = "ProcessThoroughLocal" nocase ascii wide
$string718_empire_offensive_tool_keyword = "ProcessThoroughRemote" nocase ascii wide
$string719_empire_offensive_tool_keyword = "ProcessWinSCPLocal" nocase ascii wide
$string720_empire_offensive_tool_keyword = "ps-empire client" nocase ascii wide
$string721_empire_offensive_tool_keyword = "ps-empire server" nocase ascii wide
$string722_empire_offensive_tool_keyword = "ps-empire" nocase ascii wide
$string723_empire_offensive_tool_keyword = "-PsExecCmd" nocase ascii wide
$string724_empire_offensive_tool_keyword = "-PWDumpFormat" nocase ascii wide
$string725_empire_offensive_tool_keyword = /python_modules\/keyboard\.zip/ nocase ascii wide
$string726_empire_offensive_tool_keyword = "Receive-AgentJob" nocase ascii wide
$string727_empire_offensive_tool_keyword = /ReflectivePick_x64_orig\.dll/ nocase ascii wide
$string728_empire_offensive_tool_keyword = /ReflectivePick_x86_orig\.dll/ nocase ascii wide
$string729_empire_offensive_tool_keyword = /ReleaseKeePass\.exe/ nocase ascii wide
$string730_empire_offensive_tool_keyword = "Restore-ServiceEXE -ServiceName " nocase ascii wide
$string731_empire_offensive_tool_keyword = /\-Rhost\s.{0,100}\s\-Port\s.{0,100}\s\-Cmd\s.{0,100}cmd\s\/c/ nocase ascii wide
$string732_empire_offensive_tool_keyword = "Running final exploit packet" nocase ascii wide
$string733_empire_offensive_tool_keyword = "Send the payload with the grooms" nocase ascii wide
$string734_empire_offensive_tool_keyword = "server/modules/csharp/" nocase ascii wide
$string735_empire_offensive_tool_keyword = "set CertPath data/" nocase ascii wide
$string736_empire_offensive_tool_keyword = "set CollectionMethodAll" nocase ascii wide
$string737_empire_offensive_tool_keyword = "Set Listener dbx" nocase ascii wide
$string738_empire_offensive_tool_keyword = "set Listener onedrive" nocase ascii wide
$string739_empire_offensive_tool_keyword = /set\sProfile\sapt1\.profile/ nocase ascii wide
$string740_empire_offensive_tool_keyword = "Set-DesktopACLToAllow" nocase ascii wide
$string741_empire_offensive_tool_keyword = "Set-DesktopACLToAllowEveryone" nocase ascii wide
$string742_empire_offensive_tool_keyword = "Set-Killdate" nocase ascii wide
$string743_empire_offensive_tool_keyword = /Set\-MacAttribute\.ps1/ nocase ascii wide
$string744_empire_offensive_tool_keyword = "Set-MasterBootRecord " nocase ascii wide
$string745_empire_offensive_tool_keyword = "Set-ServiceBinPath" nocase ascii wide
$string746_empire_offensive_tool_keyword = "Set-WorkingHours" nocase ascii wide
$string747_empire_offensive_tool_keyword = "SharpTemplateResources/cmd/" nocase ascii wide
$string748_empire_offensive_tool_keyword = "smb_eternalblue" nocase ascii wide
$string749_empire_offensive_tool_keyword = "smb1_anonymous_connect_ipc" nocase ascii wide
$string750_empire_offensive_tool_keyword = "smb1_anonymous_login" nocase ascii wide
$string751_empire_offensive_tool_keyword = "-SMBExec" nocase ascii wide
$string752_empire_offensive_tool_keyword = "SMBNTLMChallenge" nocase ascii wide
$string753_empire_offensive_tool_keyword = "SMBNTLMResponse" nocase ascii wide
$string754_empire_offensive_tool_keyword = "SMBRelayChallenge" nocase ascii wide
$string755_empire_offensive_tool_keyword = "SMBRelayResponse" nocase ascii wide
$string756_empire_offensive_tool_keyword = "SnifferSpoofer" nocase ascii wide
$string757_empire_offensive_tool_keyword = "SpooferHostsIgnore" nocase ascii wide
$string758_empire_offensive_tool_keyword = "SpooferHostsReply" nocase ascii wide
$string759_empire_offensive_tool_keyword = "SpooferIP" nocase ascii wide
$string760_empire_offensive_tool_keyword = "SpooferIPsIgnore" nocase ascii wide
$string761_empire_offensive_tool_keyword = "SpooferIPsReply" nocase ascii wide
$string762_empire_offensive_tool_keyword = "SpooferLearningDelay" nocase ascii wide
$string763_empire_offensive_tool_keyword = "SpooferLearningInterval" nocase ascii wide
$string764_empire_offensive_tool_keyword = "SpooferRepeat" nocase ascii wide
$string765_empire_offensive_tool_keyword = "Stage-gSharedInfoBitmap" nocase ascii wide
$string766_empire_offensive_tool_keyword = /stagers\/.{0,100}\/aes\.py/ nocase ascii wide
$string767_empire_offensive_tool_keyword = /stagers\/.{0,100}\/diffiehellman\.py/ nocase ascii wide
$string768_empire_offensive_tool_keyword = /stagers\/.{0,100}\/get_sysinfo\.py/ nocase ascii wide
$string769_empire_offensive_tool_keyword = /stagers\/.{0,100}\/rc4\.py/ nocase ascii wide
$string770_empire_offensive_tool_keyword = /StarkillerSnackbar\.vue/ nocase ascii wide
$string771_empire_offensive_tool_keyword = /Start\-MonitorTCPConnections\.ps1/ nocase ascii wide
$string772_empire_offensive_tool_keyword = "Start-ProcessAsUser" nocase ascii wide
$string773_empire_offensive_tool_keyword = /Start\-ProcessAsUser\.ps1/ nocase ascii wide
$string774_empire_offensive_tool_keyword = "Start-TCPMonitor" nocase ascii wide
$string775_empire_offensive_tool_keyword = /Start\-WebcamRecorder\.ps1/ nocase ascii wide
$string776_empire_offensive_tool_keyword = "StopInveigh" nocase ascii wide
$string777_empire_offensive_tool_keyword = "sync-starkiller" nocase ascii wide
$string778_empire_offensive_tool_keyword = "Test-ServiceDaclPermission" nocase ascii wide
$string779_empire_offensive_tool_keyword = "tree_connect_andx_request" nocase ascii wide
$string780_empire_offensive_tool_keyword = "Update-ExeFunctions" nocase ascii wide
$string781_empire_offensive_tool_keyword = "uselistener dbx" nocase ascii wide
$string782_empire_offensive_tool_keyword = "uselistener onedrive" nocase ascii wide
$string783_empire_offensive_tool_keyword = "usemodule persistence/" nocase ascii wide
$string784_empire_offensive_tool_keyword = "usemodule powershell/persistence" nocase ascii wide
$string785_empire_offensive_tool_keyword = "usemodule privesc/" nocase ascii wide
$string786_empire_offensive_tool_keyword = "useplugin csharpserver" nocase ascii wide
$string787_empire_offensive_tool_keyword = "user Inveigh" nocase ascii wide
$string788_empire_offensive_tool_keyword = /usestager\s.{0,100}backdoor/ nocase ascii wide
$string789_empire_offensive_tool_keyword = /usestager\s.{0,100}ducky/ nocase ascii wide
$string790_empire_offensive_tool_keyword = /usestager\s.{0,100}launcher_bat/ nocase ascii wide
$string791_empire_offensive_tool_keyword = /usestager\s.{0,100}launcher_lnk/ nocase ascii wide
$string792_empire_offensive_tool_keyword = /usestager\s.{0,100}shellcode/ nocase ascii wide
$string793_empire_offensive_tool_keyword = "usestager multi/launcher" nocase ascii wide
$string794_empire_offensive_tool_keyword = "WindowsEnum -" nocase ascii wide
$string795_empire_offensive_tool_keyword = "Write-CMDServiceBinary" nocase ascii wide
$string796_empire_offensive_tool_keyword = "Write-HijackDll" nocase ascii wide
$string797_empire_offensive_tool_keyword = "Write-HijackDll" nocase ascii wide
$string798_empire_offensive_tool_keyword = "Write-HijackDll" nocase ascii wide
$string799_empire_offensive_tool_keyword = "Write-PrivescCheckAsciiReport" nocase ascii wide
$string800_empire_offensive_tool_keyword = "Write-ServiceEXE " nocase ascii wide
$string801_empire_offensive_tool_keyword = "Write-ServiceEXECMD" nocase ascii wide
$string802_empire_offensive_tool_keyword = "Write-UserAddServiceBinary" nocase ascii wide
$string803_empire_offensive_tool_keyword = "WScriptBypassUAC" nocase ascii wide
$string804_empire_offensive_tool_keyword = "ZABvAHcAcwBCAHUAaQBsAHQASQBuAFIAbwBsAGUAXQAnAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAJwApACkAIAAtACAAJAAoAEcAZQB0AC0ARABhAHQAZQApACIAIAB8ACAATwB1AHQALQBGAGkAbABlACAAQwA6AFwAVQBBAEMAQgB5AHAAYQBzAHMAVABlAHMAdAAuAHQAeAB0ACAALQBBAHAAcABlAG4AZAA" nocase ascii wide
$metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
$metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
$metadata_regex_php = /<\?php/ nocase ascii
$metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
$metadata_regex_script = /<script\b/ nocase ascii
$metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
$metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
$metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
$metadata_regex_shebang = /^#!\// nocase ascii
condition:
((filesize < 20MB and (
uint16(0) == 0x5a4d or uint16(0) == 0x457f or uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or uint32(0) == 0x504B0304 or uint32(0) == 0xCAFEBABE or uint32(0) == 0x4D534346 or uint32(0) == 0xD0CF11E0 or uint16(0) == 0x2321 or uint16(0) == 0x3c3f )) and 2 of ($string*)) or
(filesize < 2MB and
(
2 of ($string*) and
for any of ($metadata_regex_*) : ( @ <= 20000 )
))
}