Sliver C2 Implant Activity Pattern

Georg Lauenstein@gsec

•updated Feb 19, 2026•1•0•57

Detects process execution patterns associated with the Sliver adversary emulation and red team framework. This rule identifies PowerShell-based UTF-8 console encoding manipulation patterns frequently observed in Sliver C2 stagers and implants, which adjust Console OutputEncoding to UTF8 prior to command execution. Such behavior may indicate unauthorized command-and-control (C2) activity or in-memory payload staging.