How do you detect Sliver C2?

Detect Sliver by matching its default network fingerprints (JARM, self-signed mTLS certificate patterns and default HTTP C2 URIs) in Zeek/Suricata, hunting repetitive same-size HTTP polling to a single destination, and on the host alerting on large (5-20MB) stripped Go binaries in user-writable paths plus the usual injection and named-pipe artifacts. For DNS mode, flag a host emitting many long high-entropy subdomains under one zone. Because Sliver is highly configurable, correlate several signals and baseline your environment.

Detecting Sliver C2: mTLS, Profiles and Implant Artifacts

Sliver (BishopFox) is now a mainstream adversary C2: free, cross-platform and modular, with mTLS, HTTP(S), DNS and WireGuard transports. Its defaults — TLS certificate fields, JARM, HTTP URIs and large stripped Go implants — give defenders plenty to work with until operators heavily customise.

Signals at a Glance

Signal	Where	ATT&CK
Default Sliver JARM / self-signed mTLS cert fields	Network, scan data	T1573.002
Default HTTP C2 URI/extension patterns (.woff/.js/.php polling)	Proxy, Zeek	T1071.001
Large (5-20MB) stripped Go binary written to disk	Sysmon 11, EDR	T1105
DNS C2 with long encoded subdomains	DNS logs	T1071.004
Regular polling interval with jitter/reconnect	Flow/proxy	T1571

Network Fingerprints

Default Sliver servers present a recognisable JARM and self-signed certificates with randomised but patterned subject fields. HTTP(S) C2 polls static-looking resources. Hunt egress to one destination with periodic small requests for resources that never change:

# Suricata-style idea (validate/tune against ET Open before deploying)
alert tls any any -> any any ( \
  msg:"HUNT Sliver default mTLS certificate pattern"; \
  flow:established,to_server; \
  tls.cert_subject; content:"CN="; \
  threshold:type limit, track by_dest, count 1, seconds 3600; \
  classtype:trojan-activity; sid:9000001; rev:1; )
# Prefer JARM/JA3 matching in Zeek + reputation over signature-only.

In Zeek, surface long-lived connections where a host repeatedly fetches the same URI with near-constant size — the hallmark of a poller:

// Zeek/KQL-style hunt: repetitive same-size fetches to one host
HttpEvents
| summarize reqs=count(), uris=dcount(UriPath), sizes=dcount(ResponseSize)
          by SrcIp, DstHost, bin(TimeGenerated, 1h)
| where reqs > 30 and uris <= 3 and sizes <= 2

Host Artifacts

Sliver implants are large, stripped Go binaries. Alert on new 5-20MB executables in user-writable paths with high entropy and no valid signature.
The implant commonly performs process-hollowing/injection for post-exploitation and spawns named pipes for pivot listeners — the same Sysmon 8/17/18 logic as other C2 applies.
For DNS mode, alert on a single host emitting many long, high-entropy subdomain lookups under one parent zone.

Vetted sources

BishopFox documents Sliver's transports; the community has published JARM values, default certificate patterns and HTTP C2 indicators. Use Zeek/Suricata (ET Open) and SigmaHQ as starting points and validate against your own baselines — Sliver is highly configurable.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Network Fingerprints

Host Artifacts

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

Havoc C2 Detection