Red-Team Tutorial Demonstrates Fileless Lateral Movement with SCShell and Sliver C2

Summary

A red-team tutorial explains how SCShell temporarily changes a Windows service configuration to run commands remotely, then restores it. A Sliver C2 lab demonstrates PowerShell payload staging, in-memory execution, and SYSTEM-context beacons.

Key points

• The video demonstrates the technique in a lab environment, not as a report of an actual incident.
• The presenter says the remote service method requires administrator access to the target, either locally or through domain privileges.
• SCShell saves a service’s original binary path, temporarily changes the service configuration, starts it to run a command, and restores the original configuration.
• The presenter describes the service method as fileless; a later example retrieves a PowerShell script over HTTP and executes it in memory.
• In the demonstration, service execution produces a SYSTEM-context beacon; the presenter notes this may differ from the operator’s prior user context.
• The tutorial shows Sliver C2’s built-in modules for service-based lateral movement and says they can avoid the need for additional tunnels.
• The presenter identifies opening a remote Service Control Manager with full access as a possible compromise indicator and says modifying Defender signatures may trigger detection.