C# Modules
Empire uses Covenant's yamls to import modules and run them through the Roslyn compiler. C# tasks are broken into two parts for Covenant and Empire. Everything external to section Empire uses the formatting defined by Covenant's task, which additional documentation can be found here.

Empire Generation

C# modules have a section called Empire in the yamls that defines Empire specific setting. These options are internal to Empire and will not be sent to the compiler. The Empire section of the yaml uses a similar formatting scheme as Python and PowerShell modules and an example of Empire yaml is below. This setup is used in the ProcessInjection module.
software: ''
techniques:
- ''
background: true
output_extension:
needs_admin: false
opsec_safe: false
comments:
- ''
options:
- name: ''
description: ''
required: true
value: ''

Advanced Generation

custom_generate: For complex modules that require custom code that accesses Empire logic, such as lateral movement modules dynamically generating a listener launcher, a custom "generate" function can be used. To tell Empire to utilize the custom generate function, set advanced.custom_generate: true
Additional information about custom_generate can be found under the PowerShell Modules custom_generate.
Copy link
On this page
Empire Generation
Advanced Generation