When tested against Elastic EDR and Windows Defender, these customized Sliver implants successfully evaded detection both on disk and in memory, demonstrating how minor modifications to open-source offensive tools can significantly challenge modern security solutions. The impact of these evasion techniques is substantial, as they allow red team operators to deploy Sliver in environments protected by modern security solutions without immediate detection, potentially extending the dwell time during security assessments or, more concerningly, during actual breaches. Fortbridge researchers identified that with relatively simple code modifications, security practitioners can significantly enhance Sliver’s ability to bypass detection mechanisms, particularly static YARA signatures employed by security products. Similar projects like better-sliver and slivercloak have implemented many of these modifications, indicating a growing trend toward customization of open-source offensive security tools to enhance their stealth capabilities. Sliver, a multi-platform Command & Control framework written entirely in Go, has gained significant traction in offensive security since its 2020 release. While these modifications allow Sliver to evade static detections, researchers note that many commands built into the Sliver implant will still trigger Elastic behavioral alerts during runtime.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 02 Apr 2025 08:25:08 +0000