Windows process command line matching Sliver C2 implant NoExit PowerShell UTF8 pattern
Alerts on Windows process command lines matching a Sliver-style PowerShell -NoExit encoding pattern.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-25
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains the specific PowerShell parameter sequence: -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8. Attackers using C2 implants may spawn PowerShell with console output encoding set to UTF-8 and keep the session alive for interactive command execution. Detection relies on process_creation telemetry and matching the exact command-line substring in the executed command.
Reporting behind it
- github.comhttps://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/implant/sliver/shell/shell_windows.go#L36
- microsoft.comhttps://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows process command line matching Sliver C2 implant NoExit PowerShell UTF8 pattern
id: f494a2c2-a416-4fe5-a14d-6838caa6795e
status: test
description: "This rule flags Windows process creation events where the command line contains the specific PowerShell parameter sequence: -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8. Attackers using C2 implants may spawn PowerShell with console output encoding set to UTF-8 and keep the session alive for interactive command execution. Detection relies on process_creation telemetry and matching the exact command-line substring in the executed command."
references:
- https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/implant/sliver/shell/shell_windows.go#L36
- https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-25
modified: 2023-03-05
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 42333b2c-b425-441c-b70e-99404a17170f
type: derived