ThreatFox: Sliver IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the Sliver C2 framework by monitoring specific indicators of compromise known to facilitate command and control communications. Proactive hunting in Azure Sentinel is critical to uncover early-stage lateral movement or data exfiltration attempts driven by this sophisticated tool before it establishes a persistent foothold within the environment.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["107.172.72.178"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["107.172.72.178"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Sliver IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune often deploy updates using custom scripts that match Sliver’s network beaconing patterns. When the system pushes a patch to thousands of endpoints, the resulting traffic volume and specific User-Agent strings can trigger the Sliver IOCs.
  • Filter/Exclusion: Create an exclusion for source IPs belonging to the internal Patch Management Server (e.g., 10.20.5.1 or the SCCM Site System IP) and filter out connections where the destination port is standard update traffic (e.g., TCP 8530, 443) originating from known management subnets during maintenance windows (e.g., 02:00 – 06:00 UTC).

• Scenario: Scheduled PowerShell Backup Jobs

  • Context: IT operations teams frequently utilize scheduled tasks running PowerShell.exe to execute backup scripts or inventory collection. These scripts often establish outbound HTTPS connections with specific TLS fingerprints that overlap with Sliver’s C2 (Command and Control) signatures, particularly if the script uses a custom HTTP client library.
  • Filter/Exclusion: Exclude alerts where the process name is powershell.exe AND the command line contains keywords like “Backup,” “Inventory,” or specific internal script paths (e.g., C:\Scripts\DailySync.ps1). Additionally, filter out traffic originating from the “System” account context during defined maintenance hours.

• Scenario: Internal DevOps CI/CD Pipeline Execution

  • Context: In a DevOps environment, tools like Jenkins, Git