Threat video1:00
Sliver Tops Cobalt Strike in Botnet C&C: Detection & IOCs
Sliver rose 58% in Spamhaus's H1 2026 botnet data, passing Cobalt Strike as top C2 family. Includes 9 detection rules (one free in Splunk SPL) and 12 IOCs.
Read the full threat intel for Sliver Tops Cobalt Strike in Botnet C&C: Detection & IOCs →
Chapters
- 0:00The hookSliver surged 58% displacing Cobalt Strike.
- 0:04The storySliver surged 58% in six months.
- 0:11Attack pathSliver and Cobalt Strike frameworks command botnet infrastructure.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise3 indicators to hunt: 1 domain and 2 c2 frameworks.
- 0:36MITRE ATT&CK techniques6 ATT&CK techniques, from resource development to command and control.
- 0:42Remediation3 steps now: Block Spamhaus DROP/BGP Botnet C&C listed IPs and domains.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Sliver surged 58% displacing Cobalt Strike.
0:05Sliver surged 58% in six months.
0:08Cobalt Strike dropped to fourth place.
0:11Sliver and Cobalt Strike frameworks command botnet infrastructure.
0:15They register C&C domains, then stand up command servers.
0:20Implants beacon back on C&C channels.
0:26No threat actor is attributed. Confidence: low.
0:313 indicators to hunt: 1 domain and 2 c2 frameworks.
0:366 ATT&CK techniques, from resource development to command and control.
0:423 steps now: Block Spamhaus DROP/BGP Botnet C&C listed IPs and domains.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.