I have a question regarding the use of mTLS as a transport protocol in Sliver.

[pythonSB]

Hello,
I have a question regarding the use of mTLS as a transport protocol in Sliver.

If I configure Sliver to use mTLS for C2 communications, are there any specific fingerprints or characteristics (such as certificate details, JA3 hashes, or traffic patterns) that could make the traffic identifiable as Sliver C2 traffic?

What would you recommend to reduce the risk of Sliver traffic being detected or fingerprinted when using mTLS?

Thank you!

[moloch--]

mTLS is designed for security, stability, and speed, and is not recommended for operations where stealthy network traffic is a significant priority. Recommend using HTTP/S for "stealthy" comms.

[pythonSB]

mTLS is designed for security, stability, and speed, and is not recommended for operations where stealthy network traffic is a significant priority. Recommend using HTTP/S for "stealthy" comms.

I am currently using both HTTPS and mTLS. I use HTTPS for stable communication, but when I need to perform certain operations, I use the mTLS protocol to establish a long connection for better speed, because I am a heavy user of Pty. As a result, my C2 server has to run on two ports. The mTLS certificate is self-generated. However, the mTLS port still gets detected as a Sliver C2, even though only the mTLS port is recognized.