LiveActive security incident?Get immediate response
MITRE ATT&CK® Tool

S0633: Sliver

Sliver is an open source, cross-platform, red team command and control (C2) framework written in Golang. Sliver includes its own package manager, "armory," for staging and downloading additional tools and payloads to the primary C2 framework.[1][2]

EnterpriseS0633ToolObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Sliver matters because it is an open-source, cross-platform command-and-control framework that can support post-compromise operations on Windows, Linux, and macOS. For leaders, the business issue is not the tool name alone; it is whether the organization can recognize C2, tool staging, discovery, credential access, privilege escalation, collection, and exfiltration behaviors that may occur through a legitimate-looking or easily modified framework.

Executive priority

Prioritize Sliver as a readiness test for endpoint, network, and incident response coverage across major operating systems. ATT&CK relationships connect Sliver to a ransomware intrusion campaign and multiple threat groups, so executives should ask whether teams can prove visibility into C2 channels, credential theft from LSASS, tool transfer, discovery activity, privilege escalation attempts, and data movement over existing C2. This is useful for resilience planning, audit evidence, and control prioritization because it validates whether defenses cover behaviors rather than only known malware signatures.

Technical view

ATT&CK does not provide a Sliver-specific detection section, so SOC and detection teams should validate coverage through the related techniques. Focus on Windows, Linux, and macOS telemetry for application-layer C2, web and DNS communications, encoded or obfuscated content, internal proxy behavior, ingress tool transfer, file and network discovery, screen capture, process injection, access token manipulation, UAC bypass, PowerShell execution, LSASS memory access, and exfiltration over C2. Because Sliver is open source and includes an armory package manager for staging and downloading additional tools and payloads, detection should combine host behavior, network patterns, and file/tool transfer evidence rather than depend on static indicators.

Likely telemetry

  • Endpoint process creation and command-line telemetry across Windows, Linux, and macOS
  • PowerShell execution logs and script block or command content where available
  • Windows security and EDR events for LSASS access, token manipulation, UAC bypass indicators, and process injection
  • Network flow, proxy, HTTP/S, WebSocket-relevant, and DNS telemetry for application-layer C2 behavior
  • File creation, download, staging, compilation, and execution evidence related to transferred tools or payloads

Detection direction

  • Validate behavior-based analytics mapped to the related ATT&CK techniques rather than relying only on Sliver names, hashes, or signatures.
  • Tune C2 detections for web and DNS traffic carefully because those protocols are common; prioritize unusual destinations, beacon-like patterns, encoded payload characteristics, and unexpected host-to-host proxying when supported by local telemetry.
  • Correlate host discovery commands, tool transfer, process injection, credential access, and outbound communications into incident-level stories to reduce false positives from administrative activity.
  • Check for blind spots on Linux and macOS, not only Windows, because the official platform field lists all three.
  • Confirm whether detections cover post-compromise use of open-source tools in ransomware-relevant scenarios, using the ATT&CK relationship to campaign C0018 as context without assuming local exposure.

Mitigation priorities

  • Establish baseline visibility first: endpoint logging, DNS/proxy/network telemetry, and centralized collection across Windows, Linux, and macOS.
  • Harden identity and endpoint controls around LSASS access, token manipulation, privileged execution, and UAC-related elevation paths where applicable.
  • Restrict and monitor unnecessary outbound application-layer traffic, DNS patterns, and internal proxying paths while accounting for business-approved services.
  • Control tool ingress and execution through application control, least privilege, and monitoring of downloads, staging directories, compilers, scripting engines, and administrative utilities.
  • Prepare IR playbooks that triage C2 discovery, credential access, tool transfer, collection, and exfiltration evidence together rather than treating each alert independently.
Additional notes and limits

The strongest decision value is to use Sliver as a cross-platform C2 coverage benchmark. ATT&CK identifies Sliver as an open-source Golang C2 framework with an armory package manager and maps it to many post-compromise techniques. Relationships also show use by campaign C0018 and groups APT29, TA551, and Cinnamon Tempest, but those relationships should be treated as ATT&CK context, not proof of current activity in any environment.

The supplied ATT&CK object has no official detection text, no aliases, and no object-level tactics. This take is therefore derived from the official description, platform list, external references, and relationship mappings. Local telemetry, approved administration patterns, egress architecture, and endpoint control capabilities are required to determine actual detection coverage or risk.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Sliver

Sliver is an open source, cross-platform, red team command and control (C2) framework written in Golang. Sliver includes its own package manager, "armory," for staging and downloading additional tools and payloads to the primary C2 framework.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

23 rows
DomainIDNameRelationship / procedure
EnterpriseT1027Obfuscated Files or Information

Sliver obfuscates configuration and other static files using native Go libraries such as `garble` and `gobfuscate` to inhibit configuration analysis and static detection.[4]

EnterpriseT1055Process Injection

Sliver includes multiple methods to perform process injection to migrate the framework into other, potentially privileged processes on the victim machine.[4][2][1][6]

EnterpriseT1083File and Directory Discovery

Sliver can enumerate files on a target system.[7]

EnterpriseT1027.004Compile After DeliverySub-technique

Sliver includes functionality to retrieve source code and compile locally prior to execution in victim environments.[2]

EnterpriseT1001.002SteganographySub-technique

Sliver can encode binary data into a .PNG file for C2 communication.[8]

EnterpriseT1134Access Token Manipulation

Sliver has the ability to manipulate user tokens on targeted Windows systems.[1][6]

EnterpriseT1059.001PowerShellSub-technique

Sliver has built-in functionality to launch a Powershell command prompt.[2]

EnterpriseT1071.004DNSSub-technique

Sliver can support C2 communications over DNS.[9][1][10][2][4]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Sliver can encrypt strings at compile time.[1][6]

EnterpriseT1573.002Asymmetric CryptographySub-technique

Sliver can use mutual TLS and RSA cryptography to exchange a session key.[9][1][11][2][4]

EnterpriseT1090.001Internal ProxySub-technique

Sliver has a built-in SOCKS5 proxying capability allowing for Sliver clients to proxy network traffic through other clients within a victim network.[2]

EnterpriseT1016System Network Configuration Discovery

Sliver has the ability to gather network configuration information.[12]

EnterpriseT1113Screen Capture

Sliver can take screenshots of the victim’s active display.[13]

EnterpriseT1071.001Web ProtocolsSub-technique

Sliver has the ability to support C2 communications over HTTP and HTTPS.[9][1][6][2][4]

EnterpriseT1105Ingress Tool Transfer

Sliver can download additional content and files from the Sliver server to the client residing on the victim machine using the upload command.[14][2]

EnterpriseT1573.001Symmetric CryptographySub-technique

Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.[11]

EnterpriseT1071Application Layer Protocol

Sliver can utilize the Wireguard VPN protocol for command and control.[2]

EnterpriseT1558.001Golden TicketSub-technique

Sliver incorporates the Rubeus framework to allow for Kerberos ticket manipulation, specifically for forging Kerberos Golden Tickets.[2]

EnterpriseT1041Exfiltration Over C2 Channel

Sliver can exfiltrate files from the victim using the download command.[15]

EnterpriseT1548.002Bypass User Account ControlSub-technique

Sliver can leverage multiple techniques to bypass User Account Control (UAC) on Windows systems.[2]

EnterpriseT1132.001Standard EncodingSub-technique

Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.[8]

EnterpriseT1003.001LSASS MemorySub-technique

Sliver has a built-in `procdump` command allowing for retrieval of memory from processes such as `lsass.exe` for credential harvesting.[2]

EnterpriseT1049System Network Connections Discovery

Sliver can collect network connection information.[17]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1021: Cinnamon Tempest

Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.[1][2][3][4]

GroupEnterprise

G0127: TA551

TA551 is a financially-motivated threat group that has been active since at least 2018. [1] The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. [2]

GroupEnterprise

G0016: APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]

CampaignEnterprise

C0018: C0018

C0018 was a month-long ransomware intrusion that successfully deployed AvosLocker onto a compromised network. The unidentified actors gained initial access to the victim network through an exposed server and used a variety of open-source tools prior to executing AvosLocker.[1][2]

Relationship explorer

All related ATT&CK context

uses · CampaignC0018: C0018Enterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · GroupG1021: Cinnamon TempestEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1027.004: Compile After DeliveryEnterpriseuses · TechniqueT1001.002: SteganographyEnterpriseuses · TechniqueT1134: Access Token ManipulationEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1071.004: DNSEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1090.001: Internal ProxyEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · GroupG0127: TA551Enterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1071: Application Layer ProtocolEnterpriseuses · TechniqueT1558.001: Golden TicketEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
25a32a49d7fdc9e9...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundle25a32a49d7fd…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  2. [2]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  3. [3]
    Cisco Talos Avos Jun 2022

    Venere, G. Neal, C. (2022, June 21). Avos ransomware group expands with new attack arsenal. Retrieved January 11, 2023.

    Open source URL
  4. [4]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  5. [5]
    Microsoft Ransomware as a Service

    Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.

    Open source URL
  6. [6]
    GitHub Sliver C2

    BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.

    Open source URL
  7. [7]
    GitHub Sliver File System August 2021

    BishopFox. (2021, August 18). Sliver Filesystem. Retrieved September 22, 2021.

    Open source URL
  8. [8]
    GitHub Sliver HTTP

    BishopFox. (n.d.). Sliver HTTP(S) C2. Retrieved September 16, 2021.

    Open source URL
  9. [9]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  10. [10]
    GitHub Sliver C2 DNS

    BishopFox. (n.d.). Sliver DNS C2 . Retrieved September 15, 2021.

    Open source URL
  11. [11]
    GitHub Sliver Encryption

    BishopFox. (n.d.). Sliver Transport Encryption. Retrieved September 16, 2021.

    Open source URL
  12. [12]
    GitHub Sliver Ifconfig

    BishopFox. (n.d.). Sliver Ifconfig. Retrieved September 16, 2021.

    Open source URL
  13. [13]
    GitHub Sliver Screen

    BishopFox. (n.d.). Sliver Screenshot. Retrieved September 16, 2021.

    Open source URL
  14. [14]
    GitHub Sliver Upload

    BishopFox. (n.d.). Sliver Upload. Retrieved September 16, 2021.

    Open source URL
  15. [15]
    GitHub Sliver Download

    BishopFox. (n.d.). Sliver Download. Retrieved September 16, 2021.

    Open source URL
  16. [16]
    Secureworks IRON HEMLOCK Profile

    Secureworks CTU. (n.d.). IRON HEMLOCK. Retrieved February 22, 2022.

  17. [17]
    GitHub Sliver Netstat

    BishopFox. (n.d.). Sliver Netstat. Retrieved September 16, 2021.

    Open source URL
  18. [18]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  19. [19]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  20. [20]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  21. [21]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  22. [22]
    mitre-attackS0633
    Open source URL
  23. [23]
    mitre-attackS0633
    Open source URL
  24. [24]
    mitre-attackS0633
    Open source URL
  25. [25]
    Cisco Talos Avos Jun 2022

    Venere, G. Neal, C. (2022, June 21). Avos ransomware group expands with new attack arsenal. Retrieved January 11, 2023.

    Open source URL
  26. [26]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  27. [27]
    Microsoft Ransomware as a Service

    Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.

    Open source URL
  28. [28]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  29. [29]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  30. [30]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  31. [31]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  32. [32]
    GitHub Sliver C2

    BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.

    Open source URL
  33. [33]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  34. [34]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  35. [35]
    GitHub Sliver File System August 2021

    BishopFox. (2021, August 18). Sliver Filesystem. Retrieved September 22, 2021.

    Open source URL
  36. [36]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  37. [37]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  38. [38]
    GitHub Sliver HTTP

    BishopFox. (n.d.). Sliver HTTP(S) C2. Retrieved September 16, 2021.

    Open source URL
  39. [39]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  40. [40]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  41. [41]
    GitHub Sliver C2

    BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.

    Open source URL
  42. [42]
    GitHub Sliver C2

    BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.

    Open source URL
  43. [43]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  44. [44]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  45. [45]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  46. [46]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  47. [47]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  48. [48]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  49. [49]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  50. [50]
    GitHub Sliver C2 DNS

    BishopFox. (n.d.). Sliver DNS C2 . Retrieved September 15, 2021.

    Open source URL
  51. [51]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  52. [52]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  53. [53]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  54. [54]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  55. [55]
    GitHub Sliver C2

    BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.

    Open source URL
  56. [56]
    GitHub Sliver C2

    BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.

    Open source URL
  57. [57]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  58. [58]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  59. [59]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  60. [60]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  61. [61]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  62. [62]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  63. [63]
    GitHub Sliver Encryption

    BishopFox. (n.d.). Sliver Transport Encryption. Retrieved September 16, 2021.

    Open source URL
  64. [64]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  65. [65]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  66. [66]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  67. [67]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  68. [68]
    GitHub Sliver Ifconfig

    BishopFox. (n.d.). Sliver Ifconfig. Retrieved September 16, 2021.

    Open source URL
  69. [69]
    GitHub Sliver Screen

    BishopFox. (n.d.). Sliver Screenshot. Retrieved September 16, 2021.

    Open source URL
  70. [70]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  71. [71]
    Bishop Fox Sliver Framework August 2019

    Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.

    Open source URL
  72. [72]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  73. [73]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  74. [74]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  75. [75]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  76. [76]
    GitHub Sliver C2

    BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.

    Open source URL
  77. [77]
    GitHub Sliver C2

    BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.

    Open source URL
  78. [78]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  79. [79]
    Microsoft Sliver 2022

    Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.

    Open source URL
  80. [80]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  81. [81]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  82. [82]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  83. [83]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  84. [84]
    GitHub Sliver Upload

    BishopFox. (n.d.). Sliver Upload. Retrieved September 16, 2021.

    Open source URL
  85. [85]
    GitHub Sliver Encryption

    BishopFox. (n.d.). Sliver Transport Encryption. Retrieved September 16, 2021.

    Open source URL
  86. [86]
    GitHub Sliver Encryption

    BishopFox. (n.d.). Sliver Transport Encryption. Retrieved September 16, 2021.

    Open source URL
  87. [87]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  88. [88]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  89. [89]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  90. [90]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  91. [91]
    GitHub Sliver Download

    BishopFox. (n.d.). Sliver Download. Retrieved September 16, 2021.

    Open source URL
  92. [92]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  93. [93]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  94. [94]
    GitHub Sliver HTTP

    BishopFox. (n.d.). Sliver HTTP(S) C2. Retrieved September 16, 2021.

    Open source URL
  95. [95]
    Cybereason Sliver Undated

    Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.

    Open source URL
  96. [96]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use