docs(adr): ADR-0095, run Sliver as the range C2 on the attack VM

[Gerrrt]

What changed

Docs only. Adds docs/adr/0095-run-sliver-as-the-range-c2-on-the-attack-vm.md, and bumps README's ADR count from 94 to 95 so check_docs.py passes.

The ADR chooses the command-and-control framework ADR-0007 and ADR-0017 call for on ifrit but never name:

• Sliver is the default, run on the attack VM inside the range. Its implant callbacks from a domain host cross VLAN 30, the segment the SOC and Zeek already watch, which is the whole point.
• Chosen to be representative and well-signatured, because the goal is to generate known, labelled activity and measure whether the estate detects it, not to evade it. An early miss is then a real gap in the estate's visibility, not an artifact of an exotic tool.
• No new firewall rule, nothing reaches the house. The listener and implants stay within the lab segment and the routeless range bridge (ADR-0014); the operator drives it from the analyst workstation, as the range is already driven.
• Mythic is the per-exercise fallback, stood up on its own guest only when an exercise needs it, so the baseline the SOC is tuned against stays one framework.
• Exercise files name the framework, transport and technique by ATT&CK ID only — no profiles, implants or keys — per security.md and the docs/exercises/ rules.

Alternatives considered (Mythic as default, Metasploit's handler, no decision) are recorded with why each was turned down.

Why

Needed before the range is built so the playground runbook's §5 and the first exercises have a concrete C2 to install. Refs #421, and pairs with the exercise log in #1191.

Blast radius

None. This changes documentation only. The decision explicitly adds no firewall rule and no path into the house.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• scripts/check_docs.py passes: docs OK — 158 Prometheus + 20 Loki rules, 8 dashboards, 156 panels, 11 assertions. The ADR number matches its filename and README's count was updated to 95.
• markdownlint-cli2 reports 0 errors on the ADR and README. Local lint's 12 Docker-based checks were skipped; I checked the ADR for trailing whitespace by hand (none). Every relative link target exists.
• Deployed to the lab and confirmed working: not applicable
• Docs updated

🤖 Generated with Claude Code

https://claude.ai/code/session_01A4769sNhNE79DH3SBN4YXx

---

Generated by Claude Code

[Copilot]

🟡 Changes recommended

It references unmerged exercise documentation and incorrectly assigns C2 operation to the defensive analyst workstation.

2 open findings

• Fix broken docs/exercises link before merging · New
• Keep C2 operator role on the Hicks workstation · New

What changed in this PR

Adds ADR-0095, selecting Sliver as the range’s default C2 framework.

Changes:

• Documents Sliver’s placement, isolation, fallback, and operational rationale.
• Updates README ADR counts from 94 to 95.

File	Description
README.md	Updates ADR inventory counts.
docs/​adr/​0095-run-sliver-as-the-range-c2-on-the-attack-vm.md	Adds the Sliver C2 decision.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Gerrrt]

Lint failed on 5e10bb0 (the merge-from-main commit) because pulling the actionlint Docker image returned 502 Bad Gateway from the registry — a transient infrastructure error, not this PR. Every other lint tool passed, and this diff is docs-only with no workflow changes for actionlint to validate. Re-running the job once.

---

Generated by Claude Code