Sliver C2 Framework TLS Certificate Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•2•0•7

This rule detects the use of the Sliver C2 Framework based on a specific pattern in the TLS certificate subject. It looks for the common name (CN) 'multiplayer' within the TLS certificate subject, which is a known indicator for Sliver C2 communications.