domains / families / security / operating-sliver-c2

operating-sliver-c2

separate

Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft.

When to use

• When conducting an authorized red-team engagement that requires a resilient, multi-protocol C2 channel
• When emulating a specific threat actor's TTPs that include Sliver (per CTI reporting) during a purple-team exercise
• When validating that EDR and network monitoring detect mTLS/HTTPS/DNS beaconing
• When demonstrating post-exploitation and lateral movement impact for a report

When not to use

• unauthorized security testing
• operating against systems without explicit written authorization

Skill page

Source