#Sliver

Open-source C2 framework by BishopFox, abused as a Cobalt Strike alternative

#Sliver

Open-source C2, abused as a Cobalt Strike alternative

Today

IOCs tagged #Sliver

Week

IOCs tagged #Sliver

Month

IOCs tagged #Sliver

Year

IOCs tagged #Sliver

Counts as of 2026-10-28. Regenerated daily.

Type: Open-source C2 framework in Go, by BishopFox.
Transports: HTTP(S), DNS, mTLS, WireGuard.
Abuse: Cobalt Strike alternative. Used by APTs and ransomware affiliates.
Why: Free and open source, so entry cost is low.
Detect: Default mTLS certs, Go implant artefacts, JA3/JA4, DNS C2 patterns, YARA.
References: MITRE ATT&CK S1056 · BishopFox/sliver on GitHub

No IOCs tagged #Sliver in the past 30 days. Year total: 39. Older data: api.tweetfeed.live/v1/year (all tags, filter for #Sliver).

Often seen with #Sliver.

See all tags on the Dashboard or browse the full IOC feed.

What is Sliver?

An open-source cross-platform C2 framework in Go, maintained by BishopFox. MITRE ATT&CK tracks it as S1056.

Is Sliver legitimate or malicious?

Sliver is a legitimate red-team tool. The IOCs here come from real intrusions where researchers saw Sliver used, not from the tool itself.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Sliver subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

Sliver IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.