Sliver

Resources regarding sliver, ill be organizing them from most useful / most straightforward to least

Videos

• https://youtu.be/watch?v=izMMmOaLn9g

• https://youtu.be/watch?v=qIbrozlf2wM

• https://youtu.be/watch?v=CKfjLnEMfvI

• https://youtu.be/3R6WKUgN0K4?t=456

• https://youtu.be/watch?v=QO_1UMaiWHk

Blogs (Organized from least to most complex)

• https://notateamserver.xyz/sliver-101/

• https://bishopfox.com/blog/passing-the-osep-exam-using-sliver

• https://dominicbreuker.com/post/learning_sliver_c2_01_installation/ (amazing resource, check out rest of blogs for some other good stuff)

• https://blog.ecapuano.com/p/so-you-want-to-be-a-soc-analyst-part-ea2

• https://wsummerhill.github.io/redteam/2023/07/25/Sliver-C2-Usage-for-Red-Teams.html

• https://dev.to/living_syn/sliver-and-cursed-chrome-for-post-exploitation-4gnk

• https://dominicbreuker.com/post/learning_sliver_c2_10_sideload/

Opsec Blogs

• https://tishina.in/opsec/sliver-opsec-notes

Development Blogs

• https://github.com/thelikes/blog/blob/master/posts/sliver-bof-dev-quickstart.md

• https://medium.com/@youcef.s.kelouaz/writing-a-sliver-c2-powershell-stager-with-shellcode-compression-and-aes-encryption-9725c0201ea8

• https://security.humanativaspa.it/customizing-sliver-part-1/

• https://security.humanativaspa.it/customizing-sliver-part-2/

• https://security.humanativaspa.it/customizing-sliver-part-3/

Detection & Analysis

Some threat actors that have used Sliver include Russian cybercrime operation APT29, also known as CozyBear

• https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors

• https://www.immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide/

• https://blogs.vmware.com/security/2023/01/detection-of-lateral-movement-with-the-sliver-c2-framework.html

• https://michaelkoczwara.medium.com/sliver-c2-implant-analysis-62773928097f

• https://blog.tofile.dev/2021/09/04/sliver.html

• https://bherunda.medium.com/hunting-detecting-smb-named-pipe-pivoting-lateral-movement-b4382bd1df4

Threat Intel Reports

• https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/

• https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors

• https://www.team-cymru.com/post/sliver-case-study-assessing-common-offensive-security-tools

• https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf

References

https://sliver.sh/docs?name=Community%20Guides

The rest came to me through a reading from an Esper