SliverCloak

Go-based build program to clone, run modules, and compile custom Sliver client and server binaries.

Why SliverCloak?

Sliver's default behavior includes an AMSI (Anti-Malware Scan Interface) patch when executing shellcode and .NET assemblies via execute-assembly and execute-shellcode. While useful, this default patch is heavily signatured and often triggers Behavior:Win32/AMSI_Patch_T.B12 alerts in Windows Defender.

SliverCloak disables this AMSI bypass by default, allowing you to:

• Avoid signatured AMSI patches that trigger EDR/AV alerts
• Use alternative bypass techniques if needed
• Build Sliver with a cleaner (less signatured) profile

Build

Note

SliverCloak requires Go 1.25+. This is because Sliver 1.6+ uses Go modules and features that are only available in modern Go versions.

Just run the make file:

$ make all
 
[*] Building cloak...
[+] Cloak built
[*] Building Sliver v1.7...
2026/07/26 11:15:18 Target version: v1.7.3
2026/07/26 11:15:18 Run directory: /tmp/output/run_1.7_20260726_111518
2026/07/26 11:15:18 Cloning Sliver...
2026/07/26 11:15:44 Running module: DonOtamsi
2026/07/26 11:15:44 Running module: Elastic
2026/07/26 11:15:45 Compiling..
[+] Sliver built
[*] Copying binaries..
[+] Binaries copied to ./output/

Build with specific flags:

make all SLIVER_VERSION=1.6 VERBOSE=1

Sessions and Lazers

Since this version changes the names of beacon to lazer, some commands have changed.

This modified version does not use the AMSI patch, so obfuscated tools work properly again. Example of running GodPotato BOF on a target.

modules

• example module
• branding module
• donutamsi module
• elastic module

Credits

• Original Creator: @thelikes