aol.pm

Sliver

Software · ATTACK:enterprise:S0633

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0633",
  "title": "Sliver",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0633",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--11f8d7eb-1927-4806-9267-3a11d4d4d6be",
  "external_id": "S0633",
  "domain": "enterprise",
  "created": "2021-07-30T15:43:17.770Z",
  "modified": "2025-03-24T16:00:41.005Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Cybereason Sliver Undated",
      "url": "https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors"
    },
    {
      "source_name": "Bishop Fox Sliver Framework August 2019",
      "url": "https://labs.bishopfox.com/tech-blog/sliver"
    }
  ]
}

Explicit source assertions (27)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0633

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--044a6e2a-df26-49aa-a485-304740fadd49

Cisco Talos Avos Jun 2022

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--051683e6-0a6a-4a40-bf5d-d2c5f25586e8

Microsoft Sliver 2022

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0633

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a0bc35b-cc76-487b-a1a7-71cbfb110f24

Microsoft Ransomware as a Service

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--223a75cd-eb8f-4477-b4c3-e2a4e651d875

GitHub Sliver C2 · Cybereason Sliver Undated · Bishop Fox Sliver Framework August 2019 · Microsoft Sliver 2022

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23149a27-cccf-4fb4-bc35-fc4ebf4c6664

GitHub Sliver File System August 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1027.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--379f7f9a-9788-49b4-b21e-6bf836be2acd

Cybereason Sliver Undated

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1001.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41b7f3d7-b42e-4301-ac9e-ecad27e826a0

GitHub Sliver HTTP

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a25798a-eca1-4841-b422-95aa3bf025e3

Bishop Fox Sliver Framework August 2019 · GitHub Sliver C2

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68aa9b71-e2a2-4beb-87ee-f1a5d016b2dc

Cybereason Sliver Undated

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73ddd025-b313-49cc-8a28-4c3869eb5a16

GitHub Sliver C2 DNS · Cybereason Sliver Undated · Bishop Fox Sliver Framework August 2019 · Microsoft Sliver 2022 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ada6af2-f97d-4a64-8eca-9fffba657d46

GitHub Sliver C2 · Bishop Fox Sliver Framework August 2019

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c593b6a-6426-4d8e-b98b-db02d1ec1025

GitHub Sliver Encryption · Cybereason Sliver Undated · Bishop Fox Sliver Framework August 2019 · Microsoft Sliver 2022 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fde1ea2-8561-4df3-8760-78d65601e305

Cybereason Sliver Undated

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8babd998-d5ca-43b4-9a68-a20d5b84cf61

GitHub Sliver Ifconfig

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bcc4714-800c-4d13-8b85-2bdf107f5fb4

GitHub Sliver Screen

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ed083f5-5fb2-4dbe-bb59-0a77b63e4a18

GitHub Sliver C2 · Cybereason Sliver Undated · Bishop Fox Sliver Framework August 2019 · Microsoft Sliver 2022 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0633

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--919ed248-2736-4024-9f0b-001c23a85d82

Cybereason Sliver Undated

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94ea901d-3904-4d84-9b0f-7df943683cd7

GitHub Sliver Upload · Cybereason Sliver Undated

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b85998e0-9f93-4cb3-a1cf-64e510b109c4

GitHub Sliver Encryption

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bea6dae9-de47-4b9d-a393-8bf543220ecb

Cybereason Sliver Undated

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2efefa6-e1e8-4817-9e62-70ba100e9432

Cybereason Sliver Undated

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6f2fa29-30fd-45c1-8adf-ed621771bd5d

GitHub Sliver Download

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d13ebdb9-f3c4-4296-b3a5-ac44d29c5c3e

Cybereason Sliver Undated

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df2a0a3b-1a23-4148-a0f7-ed5b45a0d095

GitHub Sliver HTTP

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e841a3a3-de1f-4ce2-b218-fe99afaa15fa

Cybereason Sliver Undated

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0633

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed096691-23a6-4104-879d-5e96d257b3f0

Cybersecurity Advisory SVR TTP May 2021 · Secureworks IRON HEMLOCK Profile

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcd35640-6e11-4562-a28b-7439ba8ec6f2

GitHub Sliver Netstat

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.