This hunt detects adversary activity involving the Sliver C2 framework by identifying matches against a curated set of 57 specific Indicators of Compromise (IOCs). A SOC team should proactively search for these signals in Azure Sentinel to rapidly identify and contain potential Sliver-based intrusions, which are frequently used by advanced threat actors for stealthy command and control operations.
Malware Family: Sliver Total IOCs: 57 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 193[.]111[.]62[.]133:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 150[.]40[.]117[.]127:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 116[.]198[.]204[.]146:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 5[.]187[.]6[.]96:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 148[.]113[.]37[.]70:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 45[.]142[.]142[.]204:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 132[.]243[.]168[.]75:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 178[.]105[.]206[.]245:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 43[.]160[.]235[.]200:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 13[.]63[.]50[.]133:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 85[.]122[.]114[.]42:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 85[.]121[.]176[.]71:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 47[.]80[.]18[.]76:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 15[.]204[.]173[.]19:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 178[.]105[.]31[.]148:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 162[.]35[.]160[.]163:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 138[.]226[.]236[.]13:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 195[.]58[.]137[.]115:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 67[.]217[.]228[.]212:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 185[.]165[.]171[.]156:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 107[.]175[.]202[.]19:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 159[.]65[.]113[.]187:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 212[.]2[.]34[.]64:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 211[.]154[.]20[.]87:31337 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 80[.]97[.]124[.]202:31337 | botnet_cc | 2026-07-30 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["66.179.31.126", "23.94.252.94", "193.111.62.133", "162.35.160.163", "51.158.144.212", "85.239.245.90", "144.172.114.134", "45.142.142.204", "153.75.81.30", "147.182.208.147", "107.170.13.44", "146.103.96.179", "159.203.57.140", "43.160.235.200", "211.154.20.87", "13.63.50.133", "212.2.34.64", "45.79.219.204", "159.65.113.187", "162.243.174.112", "46.225.180.111", "144.91.76.113", "78.17.212.59", "172.237.155.114", "132.243.168.75", "5.45.185.93", "50.6.37.154", "172.86.94.189", "107.175.202.19", "195.58.137.115", "64.23.192.235", "91.92.40.62", "85.121.176.71", "38.55.232.215", "15.204.173.19", "178.105.31.148", "85.122.114.42", "67.217.228.212", "51.222.139.22", "8.219.149.222", "109.123.239.6", "178.105.206.245", "138.226.236.13", "5.187.6.96", "150.40.117.127", "217.182.129.250", "38.54.59.178", "207.180.234.231", "47.80.18.76", "185.165.171.156"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["66.179.31.126", "23.94.252.94", "193.111.62.133", "162.35.160.163", "51.158.144.212", "85.239.245.90", "144.172.114.134", "45.142.142.204", "153.75.81.30", "147.182.208.147", "107.170.13.44", "146.103.96.179", "159.203.57.140", "43.160.235.200", "211.154.20.87", "13.63.50.133", "212.2.34.64", "45.79.219.204", "159.65.113.187", "162.243.174.112", "46.225.180.111", "144.91.76.113", "78.17.212.59", "172.237.155.114", "132.243.168.75", "5.45.185.93", "50.6.37.154", "172.86.94.189", "107.175.202.19", "195.58.137.115", "64.23.192.235", "91.92.40.62", "85.121.176.71", "38.55.232.215", "15.204.173.19", "178.105.31.148", "85.122.114.42", "67.217.228.212", "51.222.139.22", "8.219.149.222", "109.123.239.6", "178.105.206.245", "138.226.236.13", "5.187.6.96", "150.40.117.127", "217.182.129.250", "38.54.59.178", "207.180.234.231", "47.80.18.76", "185.165.171.156"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: Sliver IOCs detection rule, including recommended filters and exclusions tailored for an enterprise environment:
DevOps Pipeline Artifact Deployment
SYSTEM account or specific service accounts (e.g., svc-jenkins, gitlab-runner) where the parent process is jenkins.exe, gitlab-workhorse.exe, or azdo-agent. Additionally, filter out events occurring on known build server subnets (e.g., 10.20.x.x).Endpoint Security Agent Updates
falcon-sensor.exe, SentinelOneAgent.exe, or cb.exe (Carbon Black) where the file path is located in the standard installation directory (e.g., C:\Program Files\CrowdStrike\). Exclude these events if the parent process is the specific security service itself.Scheduled Patch Management Jobs