Sliver C2 Default Service Installation
Detects the installation of a Windows service by the Sliver C2 framework. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, combined with an ImagePath characteristic of Sliver (an executable in the Windows temporary directory with a 10-character alphanumeric name) or a ServiceName explicitly identifying as 'Sliver' or 'Sliver implant'. This behavior is often observed when Sliver implants use tools like PsExec to establish persistence.
Sigma
