Sliver C2 Payloads Detected in Windows Defender Lab Tests

Summary

In a Windows Server 2019 lab, the presenter tested Sliver C2 payload formats against Windows Defender. The generated variants were detected, and the presenter concluded that Sliver alone was insufficient to bypass the defenses.

Key points

• The presenter tested Sliver C2 against Windows Defender in a Windows Server 2019 lab.
• The presenter said payload detection occurred before the listener's network behavior became relevant to the test.
• The tested executable, DLL, 32-bit, template, and service-binary variants were detected.
• The presenter reported signature-based detection for some files and interpreted a short delay before another detection as behavior-based analysis.
• The presenter concluded that Sliver alone did not bypass Defender in these tests and said additional customization would be needed.