Procedure examples

Sliver can encode binary data into a .PNG file for C2 communication.

Sliver has a built-in `procdump` command allowing for retrieval of memory from processes such as `lsass.exe` for credential harvesting.

Sliver has the ability to gather network configuration information.

Sliver obfuscates configuration and other static files using native Go libraries such as `garble` and `gobfuscate` to inhibit configuration analysis and static detection.

Sliver includes functionality to retrieve source code and compile locally prior to execution in victim environments.

Sliver can encrypt strings at compile time.

Sliver can exfiltrate files from the victim using the download command.

Sliver can collect network connection information.

Sliver includes multiple methods to perform process injection to migrate the framework into other, potentially privileged processes on the victim machine.

Sliver has built-in functionality to launch a Powershell command prompt.

Sliver can utilize the Wireguard VPN protocol for command and control.

Sliver has the ability to support C2 communications over HTTP and HTTPS.

Sliver can support C2 communications over DNS.

Sliver can enumerate files on a target system.

Sliver has a built-in SOCKS5 proxying capability allowing for Sliver clients to proxy network traffic through other clients within a victim network.

Sliver can download additional content and files from the Sliver server to the client residing on the victim machine using the upload command.

Sliver can take screenshots of the victim’s active display.

Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.

Sliver has the ability to manipulate user tokens on targeted Windows systems.

Sliver can leverage multiple techniques to bypass User Account Control (UAC) on Windows systems.

Sliver incorporates the Rubeus framework to allow for Kerberos ticket manipulation, specifically for forging Kerberos Golden Tickets.

Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.

Sliver can use mutual TLS and RSA cryptography to exchange a session key.