From Red Team Toy To Real-World C2: Hunting Sliver With Microsoft Defender XDR & Sentinel

Threat Overview

• Framework:
  • Sliver is an open-source, extensible C2 framework written in Go, supporting multiple OS platforms.
  • Implants (“slivers”) can establish persistence, spawn interactive shells, exfiltrate data, and execute arbitrary commands.
• Supported C2 protocols:
  • HTTP / HTTPS
  • DNS
  • mTLS (mutual TLS, recommended by Sliver docs)
  • WireGuard (VPN-style tunnel)
  • Plain TCP (e.g., “multiplayer” operator port)
• In the wild:
  • Adoption is increasing, observed in both red-team operations and real intrusions.
  • Sliver is being used by advanced actors such as APT29.
• Why it’s hard to detect:
  • Highly configurable: URLs, encoders, ports and certificates can be changed per campaign.
  • Uses encrypted callbacks and multiple encoders (hex, Base32/58/64 with custom alphabets, “English words” encoder) to hide payloads over HTTP/DNS.
  • Supports in-memory execution, token impersonation and process injection to blend with legitimate processes.

Technical Analysis

We examine Sliver from two angles that matter most for Defender XDR and Sentinel hunts:

1. Endpoint behaviours (what the implant does on the host)
2. Network and TLS characteristics (how it communicates with C2)

• Endpoint Behaviours (Host-Level)
  • Interactive PowerShell shells
    • Sliver’s command shell frequently spawns PowerShell with explicit UTF-8 output handling.
    • Example pattern:
      • Executable: powershell.exe
      • Arguments include -NoExit and a [Text.UTF8Encoding]::UTF8 OutputEncoding tweak.
  • Token theft and impersonation
    • Uses Windows token APIs to spawn processes under stolen identities.
    • Mapped to MITRE ATT&CK T1134.001 (Access Token Manipulation: Token Impersonation).
  • Process injection
    • The default execute-shellcode command launches a benign process (commonly notepad.exe) and injects shellcode into it.
    • Mapped to MITRE ATT&CK T1055 (Process Injection).
  • Large statically linked Go binary
    • Sliver implants are often relatively large due to static Go compilation.
    • Memory scanning and YARA are effective because the Go runtime is unpacked in memory.
  • These behaviours surface clearly in Defender XDR process and behaviour analytics, and in Sysmon or EDR telemetry where available.
• Network and TLS Characteristics
  Based on research from Immersive Labs and Hunt & Hackett, several detection-friendly traits consistently appear.
  • DNS C2
    • Sliver encodes protobuf messages into DNS query names using Base58 (default) or Base32.
    • Results in very long, random-looking first labels and a high volume of unique subdomains under a single parent domain in short time windows.
  • HTTP / HTTPS C2 (Default Configuration)
    • Sliver’s default HTTP profile uses specific file extensions to indicate message types:
      • .woff – stagers
      • .html – key exchange
      • .js – long-poll session traffic
      • .php – general session messages
      • .png – close session messages
  • Additional traits:
    • Randomized directory paths with a limited set of default filenames.
    • Nonce query parameters encoding the encoder in use (hex, Base32/58/64, English words, gzip).
  • In plaintext or TLS-inspected environments, this yields:
    • Repetitive requests to random-looking paths ending in the same small set of extensions.
    • Occasional HTTP parameters consisting of unnatural word sequences.
  • mTLS and TCP C2
    • Default operator port: TLS on TCP 31337.
    • Default certificates:
      • Issuer: CN=operators
      • Subject: CN=multiplayer
    • JARM fingerprints can help identify Sliver infrastructure externally, though operators often change defaults.
  • WireGuard
    • Sliver supports WireGuard to tunnel C2 traffic.
    • In environments where WireGuard is not sanctioned, any WireGuard traffic should be treated as suspicious.

Hunting Hypothesis

One or more endpoints in the environment have been compromised with Sliver implants in the last 30 days.

If true, we expect to observe a combination of suspicious PowerShell usage, process injection behaviour, and characteristic Sliver C2 patterns across Defender XDR and Sentinel telemetry.

Expected Observations if the Hypothesis Is TRUE

• Endpoint
  • powershell.exe or pwsh.exe spawned with unusual arguments (e.g., -NoExit, UTF-8 encoding tweaks), and processes such as notepad.exe launched from uncommon parents showing signs of injection.
  • Large, uncommon executables (Go binaries) establishing outbound network connections to untrusted destinations.
• Network
  • DNS queries with long (>40–50 character) random-looking labels and high unique-subdomain counts.
  • Repeated HTTP(S) requests to random paths ending in .woff, .html, .js, .php, or .png.
  • TLS connections on unusual ports (e.g., 31337) with suspicious certificates.
  • Unexpected WireGuard traffic.

Expected Observations if the Hypothesis Is FALSE

• No sustained DNS tunnelling patterns.
• HTTP(S) traffic dominated by normal SaaS and enterprise applications.
• No Sliver-style PowerShell execution or token manipulation behaviour.
• No TLS endpoints with Sliver-like certificate attributes.

Pivots to run on any hit (quick triage)

For any candidate Sliver hit in Defender XDR / Sentinel:

• Process tree pivot
  • From the suspicious process (e.g., powershell.exe, notepad.exe, or a large unknown binary), pivot to:
    • Parent process, command line, file path, signer.
    • Child processes, especially those spawning network activity or credential tools (rundll32, regsvr32, cmd, PowerShell again, compression tools).
• Network pivot
  • From the same time window and device:
    • Review DeviceNetworkEvents for remote IPs/domains, ports, TLS metadata.
    • If C2 domains/IPs look unclassified, enrich them with WHOIS/GeoIP/reputation.
• DNS tunnelling pivot
  • For suspected domains, summarize:
    • Number of queries per device per hour.
    • Unique subdomains per domain.
    • Average label length of the first label.
• Certificate / JARM pivot
  • For TLS endpoints (mTLS/multiplayer listeners):
    • Check certificate subject/issuer for Sliver defaults.
    • If you ingest TLS metadata (from firewalls, proxies or hunt.io feeds), pivot from JARM fingerprints to historical hits.
• Scope & impact
  • Count affected devices, accounts and IPs.
  • Check whether suspicious activity continues after the initial hit (persistence, lateral movement, exfiltration).

Basic Detection & Hunting in Defender XDR & Sentinel

• Microsoft Defender XDR: Endpoint and Network CorrelationIn Microsoft Defender XDR, the Sliver implant (EMBARRASSED_NIGHT.exe) generated clear behavioural indicators that align with known Sliver HTTP C2 activity. Defender recorded multiple outbound network connections initiated by the implant to the Sliver server (172.24.47.117).Each connection followed Sliver’s characteristic HTTP profile:
  • Randomized directory paths
  • Pseudo-legitimate filenames such as .php, .js, and .html
  • Unpredictable query parameters used to carry encoded tasking and responses

  These patterns are not typical of Windows system processes or browser-generated traffic. Instead, they strongly resemble covert C2 activity designed to blend into generic web application behaviour.

  Network Evidence Observed

  Defender’s DeviceNetworkEvents telemetry highlighted repeated requests to endpoints such as:

• • /bundle/scripts/backbone.js?e=525z47315
  • /register.php?j=9s13e08738
  • /v1/v1/rpc.html?q=420×81695

All observed connections were attributed to an unsigned, unknown binary (EMBARRASSED_NIGHT.exe), which significantly elevated suspicion. Even during idle periods when no commands were issued by the operator, the implant continued beaconing, producing periodic HTTP callbacks.

When correlated with process telemetry, the behaviour became even more apparent. The implant exhibited an abnormal process tree with no legitimate parent process, combined with repetitive network connections to a single destination. This process-to-network correlation provides Defender XDR with strong visibility into Sliver’s operational footprint.

This illustrates how Defender XDR can surface C2 implants without relying on static signatures, using behavioural analytics and cross-domain correlation instead.

• Microsoft Sentinel: Behaviour-Based C2 HuntingIn Microsoft Sentinel, hunting focused on Sliver’s default HTTP C2 profile quickly surfaced the implant’s activity. Filtering for HTTP(S) connections where URL paths ended in Sliver-associated extensions (.php, .html, .js, .png, .woff) produced a concise set of suspicious URLs.The traffic showed random-looking directory structures and encoded query parameters (e.g., ?k=491904l8, ?x=22273175), matching Sliver behaviour documented by Immersive Labs and Hunt & Hackett. Aggregating results by RemoteUrl revealed repetition over time, a hallmark of beaconing malware, with most hits originating from a single endpoint repeatedly polling the same server.Even without deep packet inspection or TLS interception, Sentinel demonstrated that URL structure and repetition analysis are sufficient to detect Sliver HTTP C2. When combined with Defender XDR signals such as unsigned binaries, abnormal parent processes, and persistent communication to a single host, this approach provides a reliable, behaviour-based detection method. 

  DeviceNetworkEvents
  
  | where InitiatingProcessFileName =~ "EMBARRASSED_NIGHT.exe"
  
  | where RemoteIP == "172.24.47.117"
  
  | project TimeGenerated, RemoteUrl, InitiatingProcessCommandLine
  
  | order by TimeGenerated asc
  
  

  

MITRE ATT&CK Mapping

Based on Immersive Labs, Hunt & Hackett, and public ATT&CK mappings for Sliver:

Key controls to make Sliver deployment and C2 harder:

• Endpoint hardening & coverage
  • Ensure all Windows endpoints are onboarded to Microsoft Defender for Endpoint with tamper protection enabled.
  • Deploy Sysmon with a tuned config (e.g., SwiftOnSecurity baseline) to capture process injection and suspicious PowerShell usage.
• PowerShell & scripting controls
  • Enforce Constrained Language Mode where possible.
  • Enable PowerShell logging (ScriptBlock, Module, and Transcription) and ingest to Sentinel.
  • Restrict unneeded interpreters (PowerShell, cscript, wscript) on high-risk servers.
• Network egress controls
  • Restrict outbound traffic to only required destinations via proxies/firewalls.
  • For DNS: enforce split-horizon and filter outbound resolvers, logging all DNS queries.
  • For WireGuard/mTLS: alert on unexpected WireGuard traffic and TLS on unusual ports (e.g., 31337).
• Certificate & PKI hygiene
  • Monitor for unknown internal certificates with suspicious subjects (e.g., “multiplayer/operators”) and for self-signed C2-like certs.
• Attack surface reduction
  • Minimize local admin rights; enforce Just-In-Time access and strong MFA to limit privilege escalation impact.

If your hunts or alerts confirm Sliver activity:

• Contain
  • Use Defender XDR to isolate affected devices from the network.
  • Capture process trees, Defender alerts, and network metadata around the suspected Sliver sessions.
• Triage & forensics
  • User live response to investigate the suspicious process (where possible) and
  • Collect artifacts: executable on disk, relevant log files, DNS logs, and proxy/firewall logs.
• Eradication
  • Remove the implant (file, persistence mechanisms, scheduled tasks, registry keys).
  • Identify delivery vector (phishing, vulnerable service, RDP compromise, etc.) and close it.
• Credential reset & lateral movement review
  • Reset passwords and revoke sessions for any accounts used during the intrusion.
  • Review lateral movement indicators (remote service creation, WMI, PsExec-like usage).
• Retrospective hunts
  • Use the Sliver hunts above (and any new IOCs) to search 30–90 days back in Defender XDR and Sentinel for additional affected machines or accounts.
• Lessons learned
  • Update your EDR/SIEM rules and playbooks with what worked.
  • Add Sliver hunts to your recurring unstructured threat hunting schedule.

• Rise of open-source C2s:
  • Sliver joins Cobalt Strike, Mythic, Chaos RAT and others as mainstream frameworks in crimeware and APT playbooks.
• Configurable & modular:
  • Because operators can change ports, certificates and encoders easily, static IOCs die quickly. Behaviour-based detection is mandatory.
• Blending with “legit” tooling:
  • The same design that makes Sliver attractive to red teams (flexible shells, token impersonation, in-memory execution) makes it a problem for defenders who only focus on malware families and signatures.

If you treat Sliver as “just another red-team tool,” you’ll miss the point: it’s a generic capability stack attackers can adapt to any environment.

• Endpoints:
  • Windows workstations and servers (primary target).
  • Linux servers and occasionally macOS endpoints (depending on campaign).
• Network & perimeter devices:
  • DNS resolvers, HTTPS proxies, firewalls, and VPN gateways that carry C2 traffic.
  • External infrastructure (cloud VMs, VPS providers) used to host Sliver C2.
• Identity & access:
  • Active Directory accounts abused via token impersonation or stolen credentials.

Sliver isn’t “just” malware; it’s a framework that lets attackers plug in whatever tradecraft they need: PowerShell abuse, token theft, process injection, multi-protocol C2. That makes it harder to track as a named family and easier for operators to rebrand, recompile and redeploy.

For defenders running Microsoft Defender XDR and Sentinel, that means:

• You can’t rely on a single vendor detection or signature.
• You need behavioural hunts across endpoints, DNS and web traffic.
• You should assume Sliver (or its successors) will keep evolving as long as the offensive community does.

Treat Sliver as a baseline C2 threat: if you can reliably detect and hunt it, you’ve likely built strong coverage against many other modern frameworks too.

• TTP-Driven Hunts
  • We run recurring, behavior-based hunts designed to catch malicious C2 activity.
• Unstructured Monthly Hunts
  • Each month we investigate emerging campaigns and emerging C2 frameworks, document what we find, and advise on next steps.
• Managed Detection & Response (Defender XDR)
  • 24/7 monitoring and response: we triage alerts, contain affected machines, remove malicious processes, and guide rapid recovery.
• C2 infrastructure intelligence

• https://www.immersivelabs.com/resources/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide
• https://www.huntandhackett.com/blog/hunting-for-a-sliver
• https://hunt.io/blog/hunting-c2-panels-beginners-guide
• https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/

Mustafa Alshawwa