Introduced as a alternative to commercial tools like Cobalt Strike, Sliver has gained popularity among both security professionals and threat actors. Its modular design allows you to extend its capabilities with an extension package manager called Armory, so you can add in your own third party tools. This makes Sliver a great choice for full spectrum testing.

Features and Capabilities

Sliver has all the features you need for adversary simulation, in-memory payload execution, dynamic code generation and process injection. Its implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority, so it’s secure during operations. Sliver also has multiplayer mode so multiple operators can work together during an engagement.

Adoption by Threat Actors

While Sliver was designed for legitimate security use, its open source nature has led to adoption by threat actors. APT29 (also known as Cozy Bear) have used Sliver in their intrusion campaigns to build out robust C2 infrastructures. This is a dual use framework and we should be monitoring its use in the wild.