MalwareBazaar Database

This page shows some basic information the YARA rule Empire_PowerShell_Framework_Gen5_RID3392 including corresponding malware samples.

Database Entry

YARA Rule:Empire_PowerShell_Framework_Gen5_RID3392
Create hunting rule
Author:Florian Roth
Description:Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1
Firstseen:2022-04-20 12:04:01 UTC
Lastseen:2025-08-25 08:03:57 UTC
Sightings:4

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter