#Sliver

Sliver is an open-source cross-platform C2 framework written in Go and maintained by BishopFox. It supports HTTP(S), DNS, mTLS and WireGuard transports, multi-operator collaboration, dynamic shellcode generation and stagers - capabilities comparable to commercial frameworks like Cobalt Strike. MITRE ATT&CK tracks it as S1056.

Sliver is a legitimate red-team tool and open-source security research framework. The IOCs on this page reflect real-world intrusions where researchers observed Sliver implants or listeners being used against production targets - often by APT-aligned actors or ransomware affiliates - not the upstream tool itself. Vendor licensing is not asserted; the IOCs are observed-in-the-wild, not pre-emptive blocklists.

Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. Sliver-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.

All TweetFeed IOC data, including this Sliver subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.