Detectioncriticaltest

HackTool - Sliver C2 Implant Activity Pattern

Detects process activity patterns as seen being used by Sliver C2 framework implants

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)Created Thu Aug 25Updated Sun Mar 0542333b2c-b425-441c-b70e-99404a17170fwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains: '-NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0002 · Execution

Techniques

T1059 · Command and Scripting Interpreter

Rule Metadata

Rule ID

42333b2c-b425-441c-b70e-99404a17170f

Status

test

Level

critical

Type

Detection

Created

Thu Aug 25

Modified

Sun Mar 05

Author

Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml

Raw Tags

attack.executionattack.t1059

View on GitHub