ThreatFox: Sliver IOCs

Hunt Hypothesis

The ThreatFox: Sliver IOCs rule detects potential adversary activity associated with the Sliver C2 framework by identifying known malicious indicators linked to its infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromise attempts by advanced persistent threats leveraging Sliver.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["109.199.109.62"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["109.199.109.62"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

• Scenario: Scheduled system backup using Veeam Backup & Replication
  Filter/Exclusion: Exclude processes initiated by the veeam user or those with backup in the command line.

• Scenario: Admin task to update Sliver C2 server configuration using PowerShell
  Filter/Exclusion: Exclude processes with powershell.exe and command lines containing Set-Item or Update-Configuration.

• Scenario: Regular log collection using Splunk with a scheduled Windows task
  Filter/Exclusion: Exclude processes initiated by the splunk service or those with log or collect in the command line.

• Scenario: System integrity check using Sysmon with a custom script
  Filter/Exclusion: Exclude processes with sysmon.exe and command lines containing integrity or check.

• Scenario: Automated patch deployment using Microsoft Endpoint Manager
  Filter/Exclusion: Exclude processes initiated by the Microsoft Intune service or those with patch or update in the command line.