ThreatFox: Sliver IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Sliver implant to establish persistent command and control channels within the Azure environment, leveraging specific indicators of compromise known from recent threat intelligence. Proactive hunting for these IOCs is critical in Azure Sentinel to rapidly identify early-stage lateral movement or data exfiltration activities before they escalate into a full-blown incident.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["188.132.242.67"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.132.242.67"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Sliver
let malicious_domains = dynamic(["anyqwp6fce.localto.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Sliver IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Scanning of Sliver Artifacts

  • Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne periodically scan the network for known threat signatures. When these agents update their local IOC databases, they may generate network traffic or file system events matching Sliver indicators as part of a routine “threat intelligence sync” task, rather than an active infection.
  • Filter/Exclusion: Exclude network connections originating from the EDR management console IP range (e.g., 10.20.x.x) and filter out processes with the specific executable path of the security agent (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe).

• Scheduled Vulnerability Assessment Scans

  • Scenario: Automated vulnerability management tools such as Tenable Nessus, Qualys, or Rapid7 InsightVM run scheduled jobs to probe endpoints for known vulnerabilities. These scanners often inject test traffic or deploy lightweight agents that communicate with external threat intelligence feeds, triggering matches against Sliver IOCs during the “Discovery” or “Reporting” phases of the scan cycle (e.g., every Sunday at 02:00 AM).
  • Filter/Exclusion: Create a time-based exclusion for the specific IP addresses assigned to the vulnerability scanner management nodes and exclude traffic occurring during the defined maintenance window (e.g., 01:00–04:00 UTC) where the source process is identified as the scanner’s service executable.

• IT Administration Deployment of Security Policies

  • Scenario: System administrators utilize