Black friday Up to 3 extra licenses FOR FREE + Special offer for TI LOOKUP Get it now
Webinar
February 26
Better SOC with Interactive Sandbox Practical Use Cases
Register now

Sliver

110
Global rank
94 infographic chevron month
Month rank
96 infographic chevron week
Week rank
0
IOCs

Sliver is an open-source command-and-control (C2) framework that has been increasingly adopted by threat actors as an alternative to tools like Cobalt Strike. Developed by security firm Bishop Fox, Sliver was initially intended for legitimate security testing and red teaming exercises. However, its robust features and open-source nature have made it attractive to malicious actors seeking to control compromised systems.

C2 Framework
Type
Unknown
Origin
3 June, 2019
First seen
29 October, 2025
Last seen

How to analyze Sliver with ANY.RUN

C2 Framework
Type
Unknown
Origin
3 June, 2019
First seen
29 October, 2025
Last seen

IOCs

Last Seen at

Recent blog posts

post image
What is a Malware Sandbox? Everything SOC Ana...
watchers 275
comments 0
post image
Major Cyber Attacks in October 2025: Phishing...
watchers 2308
comments 0
post image
5 SOC Challenges and How Threat Intelligence...
watchers 431
comments 0

What is Sliver malware?

Sliver is an open-source command-and-control framework designed for adversary emulation and red teaming. First released in 2019 by Bishop Fox, it has been adopted by both security professionals and threat actors.

Malicious users leverage Sliver to establish control over compromised systems, facilitating activities such as data exfiltration, lateral movement, and deployment of additional malware.

Its distribution methods include phishing emails, malicious documents, drive-by downloads, and exploitation of vulnerabilities.

Key technical features encompass cross-platform compatibility, support for multiple communication protocols, and capabilities like process injection and token manipulation.

To see how Sliver operates inside a secure environment, you can use tools such as ANY.RUN’s sandbox.

Sliver C2 in ANY.RUN sandbox Sliver analyzed inside ANY.RUN sandbox

One of the standout features of Sliver C2 is its accessibility. Being open-source, it's easy to download and set up, with compatibility across major operating systems like MacOS, Windows, and Linux. This cross-platform nature ensures that users can implement Sliver C2 in a variety of environments.

Get started today for free

Analyze malware and phishing in a fully-interactive sandbox

Create free account

Sliver malware technical details

Sliver malware generates implants, commonly referred to as ‘slivers’, which consist of malicious code designed for remote control of compromised devices.

When a sliver is successfully deployed on a target system, it facilitates a communication channel with the central C2 server. This connection is crucial, as it enables the operator to send commands and receive data from the compromised device.

Sliver C2 supports various protocols for managing these connections, including Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS.

Sliver’s primary functionalities include:

  • Creating malicious payloads tailored to specific operating systems, which are then delivered through various vectors such as phishing emails or malicious documents.
  • Once the target executes the payload, it establishes a connection back to the Sliver C2 server, granting the attacker control over the compromised system.
  • Communicates with the C2 server at predetermined intervals using encrypted channels, aiding in evading detection.
  • Performs post-exploitation activities, such as privilege escalation, establishing persistence mechanisms, lateral movement within the network, and credential harvesting.
  • Uses techniques such as log deletion, obfuscation. The use of memory-only payloads are employed to minimize forensic evidence and hinder detection.
  • May close the C2 connection, leave backdoors for future access, or pivot to new targets to repeat the attack cycle.

Sliver malware execution process

To see how Sliver operates, let’s upload its sample to the ANY.RUN sandbox.

The execution chain of Sliver typically follows these steps: Initial access vector involves payload generation by creating a malicious payload for the target OS, delivered via phishing, malicious documents, drive-by downloads, or vulnerability exploitation.

Payload execution occurs when the target runs the payload, establishing a foothold and connecting back to the Sliver C2 server.

Command and Control (C2) begins with the infected machine beaconing to the C2 server at set intervals, using encrypted channels to avoid detection.

Sliver Suricata in ANY.RUN sandbox Suricata rule triggered by Sliver inside ANY.RUN’s sandbox

Post-exploitation activities include privilege escalation using built-in or custom tools, persistence through registry modifications or scheduled tasks, lateral movement within the network, and credential harvesting.

Data collection and exfiltration involve identifying valuable data and transmitting it back to the attacker's infrastructure, often encrypted.

Covering tracks includes log deletion and anti-forensics techniques like obfuscation and memory-only payloads. The termination or pivoting phase involves closing the C2 connection or leaving backdoors for future access and potentially pivoting to new targets to repeat the execution chain.

Sliver malware distribution methods

Attackers distribute Sliver through various methods, including:

  • Phishing emails: Sending emails with malicious attachments or links that, when opened, execute the Sliver payload.
  • Malicious documents: Embedding macros or exploits within documents that, upon execution, deploy Sliver.
  • Drive-by downloads: Compromising websites to automatically download and execute Sliver when visited.

Gathering threat intelligence on Sliver malware

To obtain up-to-date intelligence on Sliver, utilize the Threat Intelligence Lookup service.

This platform gives you access to an extensive database enriched with data from countless malware analysis sessions executed in the ANY.RUN sandbox. With over 40 customizable search parameters at your disposal, you can efficiently uncover important information on various threats, including details such as IP addresses, domains, file names, and process artifacts.

Sliver TI Lookup in ANY.RUN sandbox TI Lookup reveals key threat context related to Sliver C2

For instance, to retrieve intelligence on Sliver, you can either search for its specific threat name or utilize related artifacts. By creating a query like threatName:"sliver" and destinationIP:"", the TI Lookup will provide you with all relevant samples and sandbox analyses associated with this particular malware.

Get a 14-day free trial of Threat Intelligence Lookup along with the ANY.RUN sandbox

Integrate ANY.RUN’s threat intelligence solutions in your company

Contact us

Conclusion

Sliver’s open-source nature and cross-platform compatibility further enhance its appeal to threat actors. To defend against such threats, it’s crucial to integrate advanced analysis tools that can proactively identify and mitigate suspicious activities.

ANY.RUN is an interactive malware analysis sandbox that enables real-time examination of suspicious files and URLs. Its user-friendly interface and comprehensive analysis capabilities allow security professionals to dissect malware behavior, understand its impact, and develop effective countermeasures.

Sign up for a free account with ANY.RUN to stay ahead of emerging threats like Sliver

HAVE A LOOK AT

GuLoader screenshot
GuLoader
guloader
GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.
Read More
Tycoon 2FA screenshot
Tycoon 2FA
tycoon
Tycoon 2FA is a phishing-as-a-service (PhaaS) platform designed to bypass multi-factor authentication (MFA) protections, particularly targeting Microsoft 365 and Gmail accounts. Its advanced evasion techniques and modular architecture make it a significant threat to organizations relying on MFA for security.
Read More
Phobos screenshot
Phobos
phobos ransomware
Phobos is a ransomware that locks or encrypts files to demand a ransom. It uses AES encryption with different extensions, which leaves no chance to recover the infected files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
Bluesky Ransomware screenshot
BlueSky ransomware, first identified in June 2022, shares code similarities with other well-known ransomware families like Conti and Babuk. It primarily spreads via phishing emails and malicious links and can propagate through networks using SMB protocols. BlueSky uses advanced evasion techniques, such as hiding its processes from debuggers via the NtSetInformationThread API, making it difficult for analysts to detect and mitigate its attacks.
Read More
Chaos Ransomware screenshot
Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques.
Read More