File triage: TC_C2_Sliver_Implant_Go

1. Confirm the detection

   Sliver C2 implant (BishopFox) — open-source Cobalt Strike alternative. Detects the Go implant by its package path, robust across OS/arch and stripping. Type: **Malware**. Retrieve the file that matched: full path, SHA256 hash, size, creation date. The hash is the anchor for everything that follows.

2. Trace the file's origin

   • Which process wrote the file? (correlate file_event / Sysmon 11)
   • Provenance: download (browser/proxy), email attachment, USB drive, network share?
   • Is the file signed? by whom? valid certificate?

3. Was it executed?

   • Search for the hash/path in process_creation and image_load
   • If executed: reconstruct the chain (child processes, network connections, registry keys, persistence)
   • If never executed: the threat is likely contained to the file

4. Establish scope (fleet)

   • Search for the SAME hash across other hosts (the IOC feed and the hash are the pivots)
   • Search for the same file name / family if the hash varies (polymorphic)
   • A single host, or a campaign?

5. Response (informational, HITL)

   ⚠️ No automatic action. Contain the file; determine whether it ran before deciding on scope. File containment (quarantine), forensic collection of the host if execution is confirmed, then eradication — to be decided by a human.