Windows Process CommandLine Pattern for Sliver C2 Implant Activity

title: Windows Process CommandLine Pattern for Sliver C2 Implant Activity
id: f494a2c2-a416-4fe5-a14d-6838caa6795e
status: test
description: 'This rule flags Windows process creation events whose command line contains a specific PowerShell invocation string: "-NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8". Attackers using C2 implants commonly launch PowerShell with controlled encoding and persistent sessions, making this command pattern a useful behavioral indicator. The detection relies on process creation telemetry that includes the full command line for each spawned process.'
references:
  - https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/implant/sliver/shell/shell_windows.go#L36
  - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-25
modified: 2023-03-05
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 42333b2c-b425-441c-b70e-99404a17170f
    type: derived