Skip to content

Instantly share code, notes, and snippets.

@keyboardcrunch

keyboardcrunch/sliver_detection.md

Created February 28, 2023 02:29
Show Gist options
  • Save keyboardcrunch/2080893c0bdd6bca0b51d58d92f8da7b to your computer and use it in GitHub Desktop.
Save keyboardcrunch/2080893c0bdd6bca0b51d58d92f8da7b to your computer and use it in GitHub Desktop.
Download ZIP
Sliver Detection Ideas
Raw
sliver_detection.md

Sliver C2 Detection Research

Blog Posts

Discussions

Defaults

Process Injection (through Execute-Assembly w/o --in-process)

Default process created is notepad.exe through CreateRemoteThread.

Remote Ports

mtls: 8888 wireguard: 51820

PSExec

Default service name is "Sliver" with description like "Sliver implant" with a PathName starting with C:\Windows\Temp\

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment