A collection of tools and detections for the Sliver C2 Framework
Technical writeup - https://www.immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide/
Rules
Sliver.yar
This yara file contains two rules, one rule to detect unpacked Sliver implants and another to detect Sliver implants in memory
Sliver.snort
A collection of Snort rules to identify Sliver HTTP traffic. Due to the designed of the C2 it is possible these patterns will match on legitimate traffic.
Sliver-http.yml
A sigma rule to detect sliver HTTP traffic in event logs like Zeek or PacketBeat.
Pcap Parser
Given a domain name or IP address extract HTTP and DNS payloads for decryption.
requirements
- tshark
- pyshark
Usage
> python3 sliver_pcap_parser.py -h
usage: sliver_pcap_parser.py [-h] --pcap PCAP --filter {http,dns} [--domain_name DOMAIN_NAME]
Sliver C2 Decryptor
optional arguments:
-h, --help show this help message and exit
--pcap PCAP Path to pcap file
--filter {http,dns} Filter for HTTP, or DNS
--domain_name DOMAIN_NAME
DNS Filter requires the C2 domain name
Decrypter
Requirements
There are a number of python libraries that are required
- requirements.txt
usage
> python3 sliver_decrypt.py -h
usage: sliver_decrypt.py [-h] [--key KEY] --transport {dns,http} --file_path FILE_PATH [--force FORCE]
Sliver C2 Decryptor
optional arguments:
-h, --help show this help message and exit
--key KEY Session Key extracted from memory as hex
--transport {dns,http}
Transport Mode
--file_path FILE_PATH
path to file with encoded data
--force FORCE Brute Force Key given a procdump file