Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
9
7
6
5
1
Contributors
7
7
6
5
1
Categories
10
6
6
4
4
Platforms
19
7
6
Products / Services
8
5
4
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
1
IDS Classtypes
3
2
IDS Protocols
4
1
Detects TLS traffic featuring certificates where both the subject and issuer common name (CN) are set to 'SLIVER', which is the default configuration for the Sliver C2 framework's self-signed certificates.
The following analytic detects potential process injection attempts into executables that are commonly abused leveraging Sysmon EventCode 10.
It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files.
This activity was associated with the SliverC2 framework by BishopFox.
Monitoring this activity may indicate an initial payload attempting to execute malicious code.
It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files.
This activity was associated with the SliverC2 framework by BishopFox.
Monitoring this activity may indicate an initial payload attempting to execute malicious code.
Detects outbound HTTPS traffic on non-standard ports that matches a specific JA3 fingerprint associated with the Sliver command and control framework. This indicates potential beaconing or C2 communication from a compromised host.
Detects the execution of known Command and Control (C2) frameworks such as Sliver, Havoc, SparkRAT, or VShell from common suspicious temporary or staging directories (temp, tmp, appdata, programdata). This rule monitors process creation events to identify the presence of these unauthorized remote access tools.
Detects outbound HTTPS traffic on non-standard ports that matches a specific JA3 fingerprint associated with the Sliver command and control framework. This indicates potential beaconing or C2 communication from a compromised host.
Detects the execution of known Command and Control (C2) frameworks such as Sliver, Havoc, SparkRAT, or VShell from common suspicious temporary or staging directories (temp, tmp, appdata, programdata). This rule monitors process creation events to identify the presence of these unauthorized remote access tools.
Detects Sliver C2 framework based on default TLS certificate
Detects Sliver C2 framework based on default TLS certificate
Detects download of known offensive security and post-exploitation tools
This rule detects the use of the Sliver C2 Framework based on a specific pattern in the TLS certificate subject. It looks for the common name (CN) 'multiplayer' within the TLS certificate subject, which is a known indicator for Sliver C2 communications.
Detects download of known offensive security tools for capability acquisition
This rule detects attempts to download known exploit framework tools such as Metasploit, Cobalt Strike, Empire, Covenant, Sliver, or Havoc by inspecting HTTP URI content. The detection is based on case-insensitive pattern matching within the HTTP URI.
Detects the Golang Sliver dropper or its associated opsec.log file. This malware leverages an LLM (GPT-4) to evaluate system telemetry before deploying its payload.
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects potential Sliver C2 implant activity on Linux systems based on process execution patterns, such as in-memory execution via memfd or process name masquerading from temporary directories.
Detects the presence of a file with a specific SHA-256 hash associated with a Linux Sliver TCP Pivot implant. This implant has been linked to the CL-CRI-1036 group and is used as a precursor to 01flip ransomware deployment. The rule searches across file and process events for this high-fidelity indicator of compromise.
Detects the installation of a Windows service by the Sliver C2 framework. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, combined with an ImagePath characteristic of Sliver (an executable in the Windows temporary directory with a 10-character alphanumeric name) or a ServiceName explicitly identifying as 'Sliver' or 'Sliver implant'. This behavior is often observed when Sliver implants use tools like PsExec to establish persistence.
The analytic detects the creation of a Windows service named "Sliver" with the description "Sliver Implant," indicative of SliverC2 lateral movement using the PsExec module. It leverages Windows EventCode 7045 from the System Event log to identify this activity. This behavior is significant as it may indicate an adversary's attempt to establish persistence or execute commands remotely. If confirmed malicious, this activity could allow attackers to maintain control over the compromised system, execute arbitrary code, and further infiltrate the network.
The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
This analytic detects process injection into commonly abused Windows executables using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40, 0x1fffff, or 0x1f3fff) to processes such as notepad.exe, wordpad.exe, calc.exe, mspaint.exe, lsass.exe, svchost.exe, and web browsers, while excluding injections originating from common system paths like System32 and Program Files. This behavior is often associated with the SliverC2 framework. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code, potentially leading to privilege escalation or persistent access.
The analytic detects outbound network connections from an endpoint process to suspicious or non-standard ports. It uses Cisco Network Visibility Module flow data to identify processes communicating over ports like 4444, 2222, or 51820, which are commonly associated with tools such as Metasploit, SliverC2, other penetration testing tools, red team activities, or malware. These connections warrant further investigation, especially when initiated by unexpected or non-network-native binaries.
Page 1 of 2