PAGES
← all tools
◆ Exploitation & C2

sliver

v1.7.8 open-source

Sliver is an open-source, cross-platform adversary emulation and red team framework for authorized security testing across macOS, Windows, and Linux.

Summary

Sliver is an open-source, GPLv3-licensed adversary emulation and command-and-control framework used by red teams to run post-exploitation operations against organizations of any size. It runs as a client-server system, self-hosted on Linux, macOS, or Windows, with implants targeting the same platforms and communicating over mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with., WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer., HTTP(S), or DNS; a multiplayer mode lets several operators share one server with role-based permissions. It sits in the same space as commercial C2 frameworks used in penetration testing, offering dynamic per-binary implant compilation, in-memory execution of .NET assemblies and BOFs, process injection, and pivoting over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. or named pipes. First committed in 2019, it remains active with 137 contributors, over 500 commits in the past year, and a release roughly six months ago.

Sliver is an open-source, cross-platform adversary emulation and red team framework for authorized security testing across macOS, Windows, and Linux.

How sliver helps

Which of my compromised hosts can I still reach if the network filters outbound traffic?

implants fall back across mTLS, WireGuard, HTTP(S), and DNS, and can multiplex several of these channels over a single connection, so a session survives when one path is blocked

Can my team run one operation without stepping on each other's sessions?

multiplayer mode lets several operators connect to one server with role-based permissions, and multiple console sessions can run at once against the same implants

How do I run a .NET tool or a BOF on a target without writing it to disk?

both are executed in-memory inside the implant process, avoiding a file on the target that endpoint detection could scan

Which of my running implants are still doing something useful versus idle?

a shell can be backgrounded mid-session and resumed later, and bulk tasking can issue the same command to many implants at once, so status is tracked across sessions rather than one at a time

Will my C2 traffic look distinctive to a defender watching DNS or HTTP?

HTTP(S) C2 is procedurally generated per binary and DNS C2 can run without TXT records, changing the traffic pattern implants produce

Can I reconstruct what an operator actually did on a session after the fact?

session activity can be recorded as an asciicast for replay, and RPC-level audit logging captures operator actions server-side

all 44 features, with the evidence for each →

Languages

Not documented

Features

44 capabilities · 6 backed by code, an API document or a real run

Built from sliver's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What sliver offers you

  • Command-line interface12
  • gRPC API support1
  • REST API1
  • Scripting language support1
All capabilities 44 capabilities
Implant generation shipped Generates implants with configurable options, including naming Windows service implants at generation time. 18 releases · 2 other sources · first seen Jan 2022

release 18 total

  • Adds non-interactive support for implants stage, allowing a specific implant to be selected by name when staging from scripts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ v1.7.9 · Oct 2026 · source · release history
  • Adds --service-name flag to generate for naming Windows service implants at generation time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ v1.7.8 · Oct 2026 · source · release history
  • Adds --service-name flag to the client command to configure the installed Windows service name for implants v1.7.8 · Oct 2026 · source · release history
  • Adds go c-archive as an output format for generating static libraries instead of executables v1.7.6 · Aug 2026 · source · release history
  • Adds c-archive as a supported Go output format for implant generation, enabling implants to be embedded as C static libraries. v1.7.6 · Aug 2026 · source · release history
  • Adds background execution capability for running tasks without blocking the session. v1.7.0 · Feb 2026 · source · release history

example

  • Generate a beacon shellcode without performing reverse DNS lookups, useful in environments where DNS queries are monitored or blocked. sliver --skip-dns generate windows/amd64 beacon.exe v1.5.32 · Jan 2023 · source
  • Enable Outline authentication when configuring a private armory to restrict access. sliver-server > set armory.private.armory-name outline v1.5.16 · Jun 2022 · source
Session and credential management shipped Manages operator profiles, collects credentials from implants, steals cookies, and monitors session lifecycle. 15 releases · 3 other sources · first seen Mar 2021

release 15 total

  • Adds a notifications feature to alert operators of session and implant events. v1.6.9 · Jan 2026 · source · release history
  • Adds argument completion for aliases and extensions, enabling tab-completion of arguments when invoking custom aliases or loaded extensions in the Sliver console. v1.6.3 · Jan 2026 · source · release history
  • Adds --rc flag to supply a script file of initial inputs for automating the Sliver console at startup. v1.6.2 · Jan 2026 · source · release history
  • New aka command lets operators define custom command aliases within the Sliver console. v1.6.1 · Jan 2026 · source · release history
  • Adds experimental MCP (Model Context Protocol) support for AI-assisted C2 interaction. v1.6.1 · Jan 2026 · source · release history
  • Adds profiles info subcommand and saves poll timeout in implant profiles. v1.6.0 · Jan 2026 · source · release history

example

  • Pre-load a sequence of Sliver console commands at launch to automate repetitive setup steps or scripted operator workflows. sliver --rc /path/to/init_commands.txt v1.6.2 · Jan 2026 · source
  • Limit which implants check in by matching a locale regex, useful for geographic targeting sliver > create -o windows --locale 'en-US' payload # The LimitLocale proto field filters implant behavior based on the system locale v1.5.28 · Sep 2022 · source
  • Forcefully terminate a compromised session even if it resists standard kill signals. sliver > kill <session_id> --force v1.4.8 · Mar 2021 · source
Registry inspection shipped Reads Windows registry values and exposes associated metadata such as value type alongside the returned data. 10 releases · 2 other sources · first seen Dec 2020

release 10 total

  • Adds RegistryType field to registry read responses, exposing the value type alongside registry data. v1.7.8 · Oct 2026 · source · release history
  • Makes multiplayer WireGuard transport explicitly opt-in rather than enabled by default. v1.7.6 · Aug 2026 · source · release history
  • Improves macOS shellcode loader. v1.7.2 · Feb 2026 · source · release history
  • Adds shellcode payload generation/execution support targeting Linux implants. v1.7.1 · Feb 2026 · source · release history
  • The -n flag is removed from the reconfig command; renaming is now handled by the rename subcommand v1.5.28 · Sep 2022 · source · release history
  • Adds RegistryType to the protobuf schema to correctly distinguish registry key types. v1.5.25 · Sep 2022 · source · release history

example

  • List all subkeys under HKEY_LOCAL_MACHINE\SOFTWARE. reg list-subkeys HKLM\SOFTWARE v1.4.21 · Sep 2021 · source
  • Retrieve values for a specific registry key using the new listing capability. reg list-values HKLM\SYSTEM\CurrentControlSet\Services v1.4.21 · Sep 2021 · source
Beacon management shipped Allows operators to reconfigure, rename, filter, and monitor the status of active beacons. 11 releases · 1 other source · first seen Feb 2022

Also counts toward: Command-line interface

release 11 total

  • Adds local file tab completion for most commands and flags. v1.7.2 · Feb 2026 · source · release history
  • Adds console session asciicast recorder for session replay. v1.6.0 · Jan 2026 · source · release history
  • Beacon kill command now accepts the short form of the beacon ID as an argument, not just the full UUID. v1.5.37 · Apr 2023 · source · release history
  • The beacon list view now always includes the hostname column in its output. v1.5.37 · Apr 2023 · source · release history
  • Adds --debug-target option to specify a debug target for beacon operations v1.5.32 · Jan 2023 · source · release history
  • The info command now displays the FirstContact timestamp for beacons/sessions v1.5.28 · Sep 2022 · source · release history

example

  • Install all available implants in the current directory using the armory package manager. armory install all v1.5.14 · May 2022 · source
Payload configuration and optimization shipped Configures implant generation parameters including compression, encryption, domain fronting, proxy support, and staging. 7 releases · 1 other source · first seen Mar 2021

Also counts toward: REST API

release 7 total

  • Reduces implant sizes across obfuscated and release builds. v1.7.9 · Oct 2026 · source · release history
  • Implants can now be limited by locale using regexp via the new LimitLocale field in client.proto v1.5.28 · Sep 2022 · source · release history
  • New cursed cookies cmd subcommand with :file option steals browser cookies and saves them to disk v1.5.28 · Sep 2022 · source · release history
  • Injects locale information into implant sessions and beacons using generated protobuf definitions v1.5.27 · Sep 2022 · source · release history
  • Adds an external build API with a dedicated events API endpoint to track build progress v1.5.27 · Sep 2022 · source · release history
  • Removes backward compatibility to support v1.5 architecture changes v1.5.0 · Jan 2022 · source · release history

example

  • Limit which implants check in by matching a locale regex, useful for geographic targeting sliver > create -o windows --locale 'en-US' payload # The LimitLocale proto field filters implant behavior based on the system locale v1.5.28 · Sep 2022 · source
Transport and proxy support shipped Supports encrypted communication via WireGuard and CDN domain fronting, with HTTP/S proxy passthrough for C2 traffic. 8 releases · first seen May 2020

release 8 total

  • Adds configurable keepalive intervals for implant C2 communications. v1.7.6 · Aug 2026 · source · release history
  • Adds HTTP C2 configuration support for external builds. v1.6.0 · Jan 2026 · source · release history
  • Adds Tailscale integration for multiplayer C2 operator connectivity. v1.6.0 · Jan 2026 · source · release history
  • Adds option to disable fallback connection to TCP/80 when TCP/443 is unreachable. v1.6.0 · Jan 2026 · source · release history
  • Adds DNS C2 without TXT record support (notxt DNS mode). v1.6.0 · Jan 2026 · source · release history
  • Adds HTTP proxy fallback to direct connection when proxy fails. v1.6.0 · Jan 2026 · source · release history
Build and deployment automation shipped Integrates with GitHub armories for asset management and provides external API endpoints for monitoring build progress. 5 releases · 3 other sources · first seen May 2022

Also counts toward: Command-line interface

release

  • Adds armory support for private Github apis v1.5.36 · Mar 2023 · source · release history
  • Implements a basic external builder workflow allowing agents to be built via an external system instead of the local compiler v1.5.30 · Oct 2022 · source · release history
  • Adds the template_name field to support naming templates for external builds v1.5.30 · Oct 2022 · source · release history
  • Adds an external build API with a dedicated events API endpoint to track build progress v1.5.27 · Sep 2022 · source · release history
  • Adds armory install all command to install all armory assets v1.5.14 · May 2022 · source · release history

example

  • Configure a template name for an external build job template_name: "my-custom-template" v1.5.30 · Oct 2022 · source
  • Enable Outline authentication when configuring a private armory to restrict access. sliver-server > set armory.private.armory-name outline v1.5.16 · Jun 2022 · source
  • Install all available implants in the current directory using the armory package manager. armory install all v1.5.14 · May 2022 · source
Server connection management verified Shows and manages the current server connection, including switching between server and operator profiles. 4 releases · 3 other sources · first seen Nov 2020

release

  • Adds configurable keepalive setting to control connection idle timeouts v1.7.6 · Aug 2026 · source · release history
  • Adds server-side sequence numbers for tunnel data to ensure reliable packet ordering. v1.2.1 · Jan 2021 · source · release history
  • Adds support for specifying a custom port for DNS listeners via the -p flag v1.1.0 · Nov 2020 · source · release history
  • Introduces persistent listener jobs that survive server restarts v1.1.0 · Nov 2020 · source · release history

command line

example

  • Create a DNS listener on a non-standard port to blend in or bypass restrictions. sliver > listen dns -p 5353 v1.1.0 · Nov 2020 · source
Environment variable retrieval shipped Retrieves environment variables from a compromised agent. 5 releases · 2 other sources · first seen Nov 2020

release

  • Adds operator permissions system for role-based access control in multiplayer mode. v1.6.0 · Jan 2026 · source · release history
  • The get-env and related legacy commands are replaced by the unified env subcommand syntax. v1.4.19 · Jul 2021 · source · release history
  • Merges get-env, set-env, and related commands into the env subcommand with nested options v1.4.19 · Jul 2021 · source · release history
  • Adds the unsetenv subcommand to remove environment variables from a target process. v1.4.15 · May 2021 · source · release history
  • Adds the getenv command to retrieve environment variables from a compromised agent v1.1.0 · Nov 2020 · source · release history

example

  • Remove a specific environment variable from a running process to evade detection or clean up artifacts. unsetenv <session_id> <variable_name> v1.4.15 · May 2021 · source
  • Retrieve PATH and other env vars from an active session. sliver > getenv <agent_id> v1.1.0 · Nov 2020 · source
Shellcode encoding verified Encodes shellcode using encoders provided by the server. 5 releases · 1 other source · first seen Jan 2022

release

  • Adds shellcode encoders for payload generation. v1.6.10 · Feb 2026 · source · release history
  • Adds WASM-based Donut integration for in-memory shellcode generation. v1.6.10 · Feb 2026 · source · release history
  • Stores Shikata Ga Nai (SGN) encoding preference within implant profiles. v1.6.0 · Jan 2026 · source · release history
  • Adds RC4 encryption support to shellcode stager. v1.6.0 · Jan 2026 · source · release history
  • Introduces initial refactor to support asynchronous extension execution model v1.5.0 · Jan 2022 · source · release history

command line

Windows process token privilege enumeration shipped Enumerates token privileges on a compromised Windows host. 2 releases · 2 other sources · first seen Sep 2021

Also counts toward: Command-line interface

release

  • Makes mcp start usable non-interactively, bypassing the interactive confirmation prompt. v1.7.6 · Aug 2026 · source · release history
  • getprivs command is now available for Windows to enumerate token privileges v1.4.21 · Sep 2021 · source · release history

example

  • Enumerate token privileges on a compromised Windows host. getprivs v1.4.21 · Sep 2021 · source
  • Launch the Sliver C2 console sliver
DLL hijacking payload generation shipped Creates payloads for DLL hijacking attacks. 3 releases · 1 other source · first seen Jul 2021

Also counts toward: Command-line interface

release

  • Adds cp (copy file) command for copying files on the remote host. v1.6.0 · Jan 2026 · source · release history
  • session commands now enumerate and display Defender for Endpoint process information in the client output. v1.5.34 · Feb 2023 · source · release history
  • Adds the dllhijack command for creating DLL hijacking payloads. v1.4.20 · Jul 2021 · source · release history

example

  • Check if a target session is running Defender for Endpoint processes to assess visibility and potential detection vectors. sliver > interact <SESSION> > enum_procs <Output now includes columns or fields related to Defender for Endpoint processes> v1.5.34 · Feb 2023 · source
WireGuard C2 transport shipped Enables WireGuard as a Command & Control channel for encrypted communication. 3 releases · 1 other source · first seen Apr 2021

Also counts toward: gRPC API support

release

  • Adds --save flag to wg-config subcommand to persist WireGuard configuration changes. v1.4.12 · Apr 2021 · source · release history
  • Adds GenerateWGClientConfig RPC endpoint to generate WireGuard client configurations for new C2 channels v1.4.11 · Apr 2021 · source · release history
  • wireguard transport option enables WireGuard as a Command & Control channel v1.4.9 · Apr 2021 · source · release history

example

  • Generate a WireGuard client configuration file for a new session in an automated workflow. const config = await sliverClient.GenerateWGClientConfig(sessionID); v1.4.11 · Apr 2021 · source
File transfer enhancements shipped Adds capabilities to copy files locally on the remote host and upload entire directories. 3 releases · first seen Jan 2026

release

  • Reworks reverse port forwarding lifecycle with end-to-end coverage improvements. v1.7.7 · Sep 2026 · source · release history
  • Adds cp (copy file) command for copying files on the remote host. v1.6.0 · Jan 2026 · source · release history
  • Adds ability to upload entire directories with the upload command. v1.6.0 · Jan 2026 · source · release history
Website implant configuration management shipped Manages website implant configurations, including viewing and removing specific websites. 2 releases · 1 other source · first seen Dec 2020

Also counts toward: Command-line interface

release

  • New website info capability for inspecting hosted website details from the server. v1.6.7 · Jan 2026 · source · release history
  • Refactors websites command to use subcommands, including rm for removing websites v1.2.0 · Dec 2020 · source · release history

example

  • Remove a website implant configuration from the current session. sliver websites rm <website-name> v1.2.0 · Dec 2020 · source
Server daemon startup and asset initialization shipped Manages automatic asset initialization and startup behavior for the cyber tool server, including health check signaling and CLI setup feedback. 3 releases · first seen Apr 2021

Also counts toward: Command-line interface

release

  • Adds standard asset initialization steps during daemon mode start via the --daemon flag flow v1.4.10 · Apr 2021 · source · release history
  • Ensures non-zero exit code when daemon start fails, enabling reliable script-based health checks v1.4.10 · Apr 2021 · source · release history
  • Improves CLI user experience for asset setup commands with better echo output and argument handling v1.4.10 · Apr 2021 · source · release history
C2 and tunnel management shipped Manages reverse port forwarding tunnels and configures transport protocols including domain fronting and proxy credentials. 2 releases · first seen Sep 2022

release

  • Keeps the MCP bridge alive across idle gRPC channels, preventing disconnection after periods of inactivity. v1.7.9 · Oct 2026 · source · release history
  • Adds start and stop commands for reverse port forwarding (rportfwd) on implants v1.5.27 · Sep 2022 · source · release history
External build integration shipped Enables generating implants using external builders or custom build systems, decoupling build configuration from the server. 2 releases · first seen Aug 2026

Also counts toward: Command-line interface

release

  • Enables profiles to generate implants via external builders with profiles generate external builder, decoupling build configuration from the server. v1.7.6 · Aug 2026 · source · release history
  • Adds profiles generate external-builder subcommand to invoke custom build systems during implant generation v1.7.6 · Aug 2026 · source · release history
macOS and Linux native extension support shipped Enables running native extensions such as BOF on macOS and Linux hosts, previously limited to Windows. 2 releases · first seen Aug 2026

release

  • Enables running native extensions (BOF, etc.) directly on macOS and Linux hosts v1.7.6 · Aug 2026 · source · release history
  • Adds native extension support on macOS and Linux (previously Windows-only), broadening cross-platform BOF/extension use. v1.7.6 · Aug 2026 · source · release history
Reflektor execution engine shipped Uses Reflektor for reflective in-memory execution of extensions and BOF modules to improve isolation. 2 releases · first seen Aug 2026

release

  • Switches default BOF execution to use Reflektor, replacing the previous in-process execution model for improved isolation. v1.7.6 · Aug 2026 · source · release history
  • Switches implant extension loading to use Reflektor for reflective in-memory execution of extensions. v1.7.6 · Aug 2026 · source · release history
Metadata spoofing verified Uses a donor file directly to spoof metadata. 1 release · 1 other source · first seen Feb 2026

release

  • Implements Windows PE metadata spoofing to blend implants into target environments. v1.7.2 · Feb 2026 · source · release history

command line

  • --spoof-metadata — use the provided donor file directly. v1.7.2 · Feb 2026 · command-line history
Certificate authority management verified Lists and manages certificate authorities used by the tool. 2 other sources · first seen Jan 2026

docs

  • Open source cross-platform adversary emulation/red team framework supporting C2 over mTLS, WireGuard, HTTP(S), and DNS with dynamically compiled implants.

command line

File inspection commands shipped Provides specialized commands for reading file content including head, tail, and grep on remote hosts. 2 releases · first seen Jan 2026

Also counts toward: Command-line interface

release

  • Adds head and tail commands for reading the start/end of remote files. v1.6.0 · Jan 2026 · source · release history
  • Adds grep command for searching remote file content. v1.6.0 · Jan 2026 · source · release history
Process and registry inspection shipped Inspects Windows registry values and retrieves detailed process information including architecture and token privileges. 2 releases · first seen Sep 2022

Also counts toward: Command-line interface

release

  • ps agent command now supports a --tree flag to display the process hierarchy on the compromised host. v1.5.31 · Nov 2022 · source · release history
  • Adds RegistryType to the protobuf schema to correctly distinguish registry key types. v1.5.25 · Sep 2022 · source · release history
Automated reaction management shipped Manages automated responses and enables saving, reloading, and automatic loading of reactions on client startup. 2 releases · first seen Jul 2021

release

  • Adds save, reload, and automatic reaction loading on client startup v1.4.19 · Jul 2021 · source · release history
  • Adds the reaction command for managing automated responses v1.4.19 · Jul 2021 · source · release history
macOS network socket inspection shipped Inspects network connections on macOS hosts via implant commands. 1 release · 1 other source · first seen May 2021

release

  • Enables macOS network socket inspection via the netstat implementation on Darwin implants. v1.4.15 · May 2021 · source · release history

example

  • Inspect network connections on a macOS host directly from the implant command interface. netstat -an v1.4.15 · May 2021 · source
Password cracking shipped Provides a real-time dashboard for monitoring and benchmarking password cracking activity. 1 release · first seen Oct 2026

release

  • Redesigns crack top as a real-time dashboard with a top panel and benchmark cache policy. v1.7.8 · Oct 2026 · source · release history
CNA script management verified Provides commands to load, run, unload, and compile CNA scripts directly from the CLI. 1 other source · first seen Sep 2026

Also counts toward: Command-line interface

command line

OPFOR CNA scripting shipped Adds support for scripting with OPFOR CNA BOF modules. 1 release · first seen Sep 2026

Also counts toward: Scripting language support

release

Background shell management shipped Allows operators to background interactive shells, list active shells, and re-attach them. 1 release · first seen Feb 2026

Also counts toward: Command-line interface

release

  • Adds multi-shell management: background a shell with ctrl+], list active shells with shell ls, and re-attach with shell attach. v1.7.2 · Feb 2026 · source · release history
Local shell tunnel management verified Attaches to and manages local shell tunnels. 1 other source · first seen Feb 2026

Also counts toward: Command-line interface

command line

Linux implant support shipped Adds shellcode payload generation and execution capabilities specifically targeting Linux implants. 1 release · first seen Feb 2026

release

  • Adds shellcode payload generation/execution support targeting Linux implants. v1.7.1 · Feb 2026 · source · release history
Multi-console sessions shipped Enables multiple simultaneous console sessions within the Sliver client for concurrent operator access. 1 release · first seen Feb 2026

release

  • Enables multiple simultaneous console sessions (multi-console) within the Sliver client. v1.7.1 · Feb 2026 · source · release history
C2 multiplexing shipped Enables multiple C2 channels over a single connection to increase efficiency and resilience. 1 release · first seen Feb 2026

release

  • Adds C2 multiplexing (mux) support, enabling multiple C2 channels over a single connection. v1.7.0 · Feb 2026 · source · release history
Darwin/ARM64 shellcode support shipped Adds shellcode generation support for Darwin/arm64 targets. 1 release · first seen Feb 2026

release

  • Adds shellcode generation support for Darwin/arm64 (Apple Silicon) targets. v1.7.0 · Feb 2026 · source · release history
In-memory shellcode generation shipped Generates shellcode payloads using WASM-based Donut integration and supports execution in memory. 1 release · first seen Feb 2026

release

  • Adds WASM-based Donut integration for in-memory shellcode generation. v1.6.10 · Feb 2026 · source · release history
Certificate database storage shipped Stores certificates in a database to improve management capabilities alongside existing CA lists. 1 release · first seen Jan 2026

release

  • Adds certificate storage in a database (certs db) for improved cert management. v1.6.9 · Jan 2026 · source · release history
YAML configuration support shipped Supports YAML format for configuration files, enabling human-readable configs alongside existing formats. 1 release · first seen Jan 2026

release

  • Supports YAML format for configs, enabling human-readable configuration files alongside existing formats. v1.6.8 · Jan 2026 · source · release history
SQLite database tuning shipped Adds SQLite pragma support to the database configuration for tuning database behavior. 1 release · first seen Jan 2026

release

  • Adds SQLite pragma support to the database configuration for tuning database behavior. v1.6.7 · Jan 2026 · source · release history
DNS C2 improvements shipped Adds DNS C2 support without TXT record requirements (notxt mode) for greater flexibility. 1 release · first seen Jan 2026

release

  • Adds DNS C2 without TXT record support (notxt DNS mode). v1.6.0 · Jan 2026 · source · release history
In-memory file operations shipped Allows reading and writing files directly in memory on implants without touching the disk. 1 release · first seen Jan 2026

release

  • Adds memory file feature for in-memory file operations on implants. v1.6.0 · Jan 2026 · source · release history
In-memory process dumping shipped Dumps process memory in-memory on Windows to avoid disk artifacts. 1 release · first seen Sep 2021

release

  • Process dump mechanism switches to in-memory dumping on Windows instead of writing to disk v1.4.21 · Sep 2021 · source · release history
Hex dump output shipped Outputs file contents as hexadecimal dumps. 1 release · first seen Jul 2021

release

  • Adds hex dump output support to the existing cat command. v1.4.20 · Jul 2021 · source · release history
macOS and Linux process details shipped Retrieves CLI arguments and process owner information for processes on macOS and Linux hosts. 1 release · first seen May 2021

release

  • Extends the ps implant command with CLI argument support and process owner display for Darwin and Linux hosts. v1.4.15 · May 2021 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Screenshots

From the release notes, newest first. Click one to see it full size.

CVE-2026-25760 Feb 5, 2026

CVE-2025-27093 Oct 27, 2025

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for sliver, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail sliver puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

71 entries

  1. October 20261
  2. September 20261
  3. August 20261
  4. July 20261
  5. March 20263
  6. February 20266
  7. January 20267
  8. October 20251
  9. February 20251
  10. July 20241
  11. June 20231
  12. May 20231
  13. April 20231
  14. March 20231
  15. February 20231
  16. January 20231
  17. November 20221
  18. October 20221
  19. September 20224
  20. August 20222
  21. July 20222
  22. June 20222
  23. May 20222
  24. April 20221
  25. March 20222
  26. February 20222
  27. January 20221
  28. October 20211
  29. September 20211
  30. July 20213
  31. May 20211
  32. April 20216
  33. March 20215
  34. February 20211
  35. January 20211
  36. December 20201
  37. November 20201
  38. May 20201
    Show

    71 entries

    Project health

    Issue, contributor and maintainer activity in BishopFox/sliver, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 31 +11 vs prior 12 months
    2. Maintainers 1 +1 joined · −3 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 144 days first maintainer reply 44 hours
    6. Open backlog 203 of 929 issues ever filed
    1. Issues opened / month 1 · 0 communitymaintainers
    2. Open backlog 203
    3. Contributors / month 3
    4. Commits / month 38
    5. Stars 11,863
    Issue themes, last 12 months
    • bugs 34%
    • features 16%
    • questions 3%
    • docs 1%
    • other 46%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Articles

    15 articles · updated Nov 4, 2026

    Where sliver turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.

    • Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry SOCRadar
      Core infrastructure runs on a bare Yandex Cloud IP hosted in Moscow (AS13238), with a professional Sliver C2 framework using mTLS and HTTP listeners.
      2 more quotes
      Hands-on targeting of Ukraine: Sliver console recordings show the operator working interactively on a compromised Ukrainian railway logistics operator, enumerating and dumping databases on a server set to the…
      A tooling profile that fits: Sliver mTLS + HTTP C2, the 3x-ui/Xray panel, WireGuard, the Russian-built Gost SOCKS5 tunneler, and a modern Windows toolchain, all tied to the root@talked SSH key that named the operation.
    • Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection Darktrace
      The intrusion also involved the use of Sliver , an open-source adversary emulation framework, which is increasingly observed in real-world attacks.
      2 more quotes
      Originally designed for penetration testing and red teaming, Sliver has gained traction among threat actors as a stealthier alternative to more heavily signatured frameworks such as Cobalt Strike.
      Concurrently, Darktrace identified command-and-control (C2)-style communications consistent with the Sliver framework, alongside rare outbound connections to cloud infrastructure indicating potential data exfiltration.
    • PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale SentinelOne Labs
      Second Toolset | Credential Harvester & Sliver Beacons We also identified another toolset on the attacker’s payload delivery server unrelated to the previous one.
      2 more quotes
      The script detects CPU architecture and pulls the matching Sliver binary: update.bin , update-386.bin , or update-arm.bin , depending on the system architecture.
      Sliver ELF Binaries The update binaries are Sliver C2 beacons compiled with the garble obfuscation tool, which scrambles Go type names and removes build metadata to hinder signature-based detection.
    Show all 6

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →