Sliver C2 - Detect
ID: sliver-c2
Severity: info
Author: johnk3r
Tags: c2,ssl,ir,osint,malware,sliver,tls
Description
Section titled “Description”Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server
YAML Source
Section titled “YAML Source”id: sliver-c2
info: name: Sliver C2 - Detect author: johnk3r severity: info description: | Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server reference: | https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver metadata: verified: "true" max-request: 1 shodan-query: product:"Sliver C2" tags: c2,ssl,ir,osint,malware,sliver,tlsssl: - address: "{{Host}}:{{Port}}" matchers-condition: and matchers: - type: word part: issuer_cn words: - "operators"
- type: word part: subject_dn words: - "CN=multiplayer"
extractors: - type: json json: - " .issuer_cn"# digest: 490a0046304402200fc1d4fa30494e81c06ea2b45409484f6f8305559d8317b1459a642402e3d2320220131cbeb10f45c93b9aa7a021f2e56a623f6a5d7d957850b64cc409930dae555b:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "ssl/c2/sliver-c2.yaml"