ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving Sliver C2 framework indicators by matching network and host telemetry against five specific threat intelligence signatures. Proactive hunting for these IOCs within Azure Sentinel is critical to rapidly uncover stealthy command-and-control communications that may evade standard signature-based defenses, thereby reducing the dwell time of advanced persistent threats.

IOC Summary

Malware Family: Sliver Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`43[.]134[.]169[.]103:31337`	botnet_cc	2026-08-09	75%
ip:port	`43[.]134[.]169[.]103:40056`	botnet_cc	2026-08-09	75%
ip:port	`138[.]2[.]87[.]233:25745`	botnet_cc	2026-08-09	75%
ip:port	`138[.]2[.]87[.]233:30462`	botnet_cc	2026-08-09	75%
ip:port	`138[.]2[.]87[.]233:31337`	botnet_cc	2026-08-09	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["43.134.169.103", "138.2.87.233"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.134.169.103", "138.2.87.233"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Sliver IOCs detection rule in an enterprise environment:

Scenario 1: Automated Patching via WSUS/SCCM
- Context: The Sliver C2 framework often utilizes specific HTTP User-Agent strings or certificate hashes that overlap with Microsoft System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS). When the endpoint agent communicates with the update server to download patches, it may trigger a match on the “HTTP User-Agent” IOC.
- Filter/Exclusion: Exclude traffic originating from the SCCM site system IP range (10.20.30.0/24) or filter out events where the ProcessName is WUAEngine.exe and the destination port is 8530 (standard WSUS port).
Scenario 2: Scheduled Backup Jobs Using Sliver-Compatible Protocols
- Context: Enterprise backup solutions like Veeam or Commvault often employ custom TCP ports and specific TLS fingerprints for data transfer. If a scheduled nightly backup job initiates a connection that matches the “TLS Certificate Hash” or “TCP Port” IOCs defined in the Sliver hunt package, it will generate a hit despite being legitimate administrative activity.
- Filter/Exclusion: Create an exclusion based on ProcessName containing vrb.exe (Veeam) or commvault_agent.exe, and restrict the rule to trigger only during non-business hours (02:00–06:00) if the backup window is known, or explicitly whitelist the backup server’s FQDN.
Scenario 3: DevOps CI/CD Pipeline Artifacts
- Context: In environments using Jenkins or GitLab Runners, build agents frequently download dependencies and upload artifacts to