Sliver

Sliver is an open-source, cross-platform command and control (C2) framework used by both security professionals and malicious actors for penetration testing and cyber attacks. Developed by Bishop Fox, a cybersecurity consulting firm, Sliver is designed to simulate real-world attack scenarios, allowing security teams to test their defenses. However, its capabilities have also been leveraged by threat actors for malicious purposes. As of October 2023, Sliver remains a tool of interest in the cybersecurity community due to its versatility and effectiveness in mimicking advanced persistent threats (APTs).

Overview

Sliver is a C2 framework that supports multiple operating systems, including Windows, Linux, and macOS. It is written in the Go programming language, which contributes to its cross-platform compatibility. Sliver provides a range of features, including payload generation, session management, and network evasion techniques. These features make it a valuable tool for both ethical hacking and malicious activities. The framework is modular, allowing users to customize and extend its capabilities to suit specific needs.

History

Sliver was developed by Bishop Fox and released as an open-source project to provide an alternative to other C2 frameworks like Cobalt Strike and Metasploit. Since its release, Sliver has gained popularity among security professionals for its ease of use and robust feature set. However, its open-source nature has also made it accessible to cybercriminals. Over time, Sliver has evolved with updates that enhance its functionality and address security concerns.

Technical characteristics

Sliver's architecture consists of several key components, including the server, agents, and operators. The server acts as the central hub for managing operations and communications. Agents are deployed on target systems to execute commands and report back to the server. Operators interact with the server to control agents and conduct operations.

Sliver supports multiple communication protocols, including HTTP, HTTPS, and DNS, enabling it to bypass network defenses. It also features built-in encryption to secure communications between agents and the server. The framework's modular design allows users to develop custom modules for specific tasks, enhancing its adaptability.

Infection vector

Sliver can be delivered to target systems through various methods, including phishing emails, drive-by downloads, and exploiting vulnerabilities in software. Once deployed, the Sliver agent establishes a connection with the server, allowing operators to execute commands and gather information from the compromised system. The framework's ability to use multiple communication protocols aids in evading detection by security tools.

Notable campaigns

While Sliver is primarily used by security professionals for legitimate purposes, it has been identified in several cyber attack campaigns. For instance, security researchers have observed threat actors using Sliver in conjunction with other tools to conduct [lateral movement] and data exfiltration. Specific campaigns remain largely undisclosed due to the sensitive nature of the information and ongoing investigations.

Detection and mitigation

Detecting Sliver involves monitoring network traffic for unusual patterns, such as unexpected outbound connections or encrypted communications. Security teams can employ intrusion detection systems (IDS) and endpoint detection and response (EDR) solutions to identify and block Sliver-related activities. Regularly updating software and applying security patches can reduce the risk of exploitation by Sliver.

Mitigation strategies include implementing strict access controls, conducting regular security assessments, and training employees to recognize phishing attempts. By understanding the capabilities of Sliver, organizations can better prepare to defend against its misuse.

See also

• [lateral movement]

Sources

Sources will be added automatically.