Hunting Sliver behavior with Defender XDR and Sentinel

Sliver is a legitimate red-team framework and a threat-hunting target. Both statements are true.

Bishop Fox develops Sliver as an open-source alternative to commercial C2 platforms. Its current product page lists mTLS, WireGuard, HTTP(S) and DNS transports, staged and stageless payloads, in-memory execution, process migration, process injection and token manipulation.

Microsoft reported in 2022 that nation-state actors, ransomware-linked cybercrime groups and other threat actors had adopted Sliver. Microsoft also published Defender XDR hunting queries based on lab simulations and observed activity.

The framework facts and queries in this note come from those sources. My contribution is how I would operate the hunts in Defender XDR and Sentinel based on detection-engineering experience. This is not novel Sliver research or a disclosed customer incident.

Start with the source boundary

Microsoft made an important qualification: unless otherwise noted, its hunting guidance was designed for the official, non-customized Sliver codebase available when the article was published in August 2022.

That gives defenders two query classes:

• exact defaults, which can be precise but are easy for an operator to change;
• underlying behaviors, which survive more customization but produce more investigation work.

Do not collapse them into one confidence score without testing. An exact default command can justify a fast escalation. A generic process-injection event needs more context.

Hunt 1: the default interactive shell command

Microsoft published this exact command-line hunt for Sliver's default interactive shell:

DeviceProcessEvents
| where ProcessCommandLine ==
    'powershell.exe -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8'

Keep the exact query because it is cheap and understandable. Also run a broader variant to catch spacing or executable changes:

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_all ("-NoExit", "OutputEncoding", "UTF8")
| project Timestamp, DeviceId, DeviceName, AccountName,
    ProcessCommandLine, InitiatingProcessFileName,
    InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

The broader query is not Sliver-specific. Developer terminals and administrative tooling can produce similar commands.

Hunt 2: GetSystem behavior

Microsoft's GetSystem hunt looks for a process enabling SeDebugPrivilege and creating a remote thread in spoolsv.exe within 30 seconds.

let SeDebugPriv = 1048576;
DeviceEvents
| where FileName == "spoolsv.exe"
| where ActionType == "CreateRemoteThreadApiCall"
| where InitiatingProcessFileName !~ "csrss.exe"
| project InitiatingProcessId, DeviceId,
    CreateTime = Timestamp, FileName
| join kind=inner (
    DeviceEvents
    | where ActionType == "ProcessPrimaryTokenModified"
    | extend TokenModTime = Timestamp
) on DeviceId, InitiatingProcessId
| where TokenModTime between ((CreateTime - 30s) .. CreateTime)
| extend EventData = parse_json(AdditionalFields)
| where binary_xor(
    tolong(EventData.OriginalTokenPrivEnabled),
    tolong(EventData.CurrentTokenPrivEnabled)
) == SeDebugPriv
| where binary_and(
    tolong(EventData.CurrentTokenPrivEnabled),
    SeDebugPriv
) != 0
| extend TargetProcessFileName = FileName
| project-reorder DeviceName, InitiatingProcessFileName,
    TargetProcessFileName, InitiatingProcessId

This query is more valuable as a behavior hunt than as a family label. The privilege and remote-thread sequence can identify suspicious elevation and injection even when the tool is not Sliver.

Hunt 3: default injection into notepad.exe

Microsoft documented that the default Sideload, SpawnDll and Execute-Assembly commands spawned and injected into notepad.exe. Its hunt correlates process creation with a remote-thread event:

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine =~ "notepad.exe"
| distinct InitiatingProcessId, DeviceId
| join kind=inner (
    DeviceEvents
    | where ActionType == "CreateRemoteThreadApiCall"
    | where ProcessCommandLine == "notepad.exe"
    | where Timestamp between (
        ProcessCreationTime .. (ProcessCreationTime + 10s)
    )
) on DeviceId, InitiatingProcessId

Do not replace this with a claim that every network connection from Notepad is Sliver. The source supports the process-injection sequence for default commands. Attribution still requires the parent process, memory evidence, payload or configuration, network context and related activity.

A broader process-injection review can start here:

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType in~ (
    "CreateRemoteThreadApiCall",
    "QueueUserApcRemoteApiCall",
    "SetThreadContextRemoteApiCall"
)
| where FileName in~ (
    "notepad.exe",
    "spoolsv.exe",
    "rundll32.exe",
    "regsvr32.exe"
)
| project Timestamp, DeviceId, DeviceName, ActionType,
    FileName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, InitiatingProcessId,
    ProcessId, AdditionalFields
| order by Timestamp desc

Treat this as a queue for investigation, not an automatic Sliver alert.

Hunt 4: default PsExec service artifacts

Microsoft also published registry and service-installation hunts for Sliver's default PsExec behavior.

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where
    (
        RegistryValueName == "ImagePath"
        and RegistryValueData matches regex
            @"^[a-zA-Z]:\\windows\\temp\\[a-zA-Z0-9]{10}\.exe"
    )
    or (
        RegistryValueName == "DisplayName"
        and RegistryValueData == "Sliver"
    )
    or (
        RegistryValueName == "Description"
        and RegistryValueData == "Sliver implant"
    )

The service-event alternative is useful when registry telemetry is incomplete:

DeviceEvents
| where ActionType == "ServiceInstalled"
| extend EventData = parse_json(AdditionalFields)
| where
    (
        FolderPath endswith_cs @":\windows\temp"
        and FileName matches regex @"^[a-zA-Z0-9]{10}\.exe"
    )
    or EventData.ServiceName == "Sliver"
| project Timestamp, DeviceId, DeviceName, FolderPath,
    FileName, EventData, InitiatingProcessFileName,
    InitiatingProcessCommandLine

A customized service name or path will evade these defaults. Keep separate lateral-movement detections for remote service creation and unusual binaries in Windows Temp.

How I would operate these in Sentinel

Do not start with one large composite rule. First measure each signal:

1. Run the exact shell query over retained history.
2. Baseline privilege changes and remote-thread events.
3. Review injection targets and parent processes.
4. Review remote service creation from unusual accounts and devices.
5. Add exclusions only when the benign owner and mechanism are known.

Then split the analytics:

• high precision: exact default shell or explicit Sliver service values;
• medium precision: privilege change plus remote thread into spoolsv.exe;
• hunting only: generic injection events and unusual service installation.

The distinction prevents a broad technique hunt from being presented as certain malware attribution.

Response when a hunt returns evidence

For a credible hit:

1. Isolate the affected endpoint according to the incident runbook.
2. Preserve process, service, registry, network and memory evidence.
3. Trace the initiating process and initial-access path.
4. Extract C2 configuration from the implant or process memory when possible.
5. Hunt the resulting addresses, certificates, hashes and parent-child patterns across the environment.
6. Review privilege escalation, remote execution, lateral movement and credential access around the same device and identity.

Microsoft notes that Sliver configuration is obfuscated at rest but must be available to the implant in memory when used. That makes memory collection useful during a live investigation. It does not guarantee that every sample can be decoded automatically.

What this article deliberately does not claim

The assigned sources do not support universal thresholds for DNS label length, a dependable default port, a current false-positive rate or a 2026 ranking of which actor uses Sliver most often. Those claims have been removed.

The durable finding is behavior-based: C2 frameworks still need to execute, inject, change privileges, install services and communicate. Hunt those actions, keep exact defaults as bonus precision and attribute only after the evidence supports it.

For adjacent hunts, see the TA584 and Tsundere Bot note and the SharePoint AiTM response guide.

Sources

• Microsoft Defender Experts: Looking for the Sliver lining: Hunting for emerging command-and-control frameworks
• Bishop Fox: Sliver open-source C2 framework