The ThreatFox: Sliver IOCs rule detects potential adversary activity associated with the Sliver C2 framework by identifying known malicious indicators linked to its infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromise attempts by advanced persistent threats leveraging Sliver.
IOC Summary
Malware Family: Sliver Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 43[.]136[.]92[.]170:31337 | botnet_cc | 2026-06-07 | 75% |
| ip:port | 43[.]136[.]92[.]170:8443 | botnet_cc | 2026-06-07 | 75% |
| ip:port | 203[.]88[.]125[.]186:31337 | botnet_cc | 2026-06-07 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["203.88.125.186", "43.136.92.170"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["203.88.125.186", "43.136.92.170"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Scheduled system integrity check using PowerShell to verify file hashes
Filter/Exclusion: ProcessName != "powershell.exe" OR CommandLine NOT LIKE '%Get-FileHash%'
Scenario: Sliver is being used for legitimate red team exercises in a controlled environment
Filter/Exclusion: ProcessName == "sliver.exe" OR CommandLine LIKE '%--redteam%'
Scenario: Windows Task Scheduler runs a legitimate script that matches the IOC pattern
Filter/Exclusion: ProcessName == "schtasks.exe" OR CommandLine LIKE '%/RU SYSTEM%'
Scenario: Windows Event Log collection tool (e.g., LogParser) is querying event logs and matches IOC patterns
Filter/Exclusion: ProcessName == "logparser.exe" OR CommandLine LIKE '%-i EventLog%'
Scenario: Windows Admin Center or PowerShell remoting is used for remote management and triggers IOC matches
Filter/Exclusion: ProcessName == "winrm.exe" OR CommandLine LIKE '%-Configuration%'