The ThreatFox: Sliver IOCs rule detects potential adversary activity linked to the Sliver C2 framework by identifying known malicious indicators associated with its command and control infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromise from advanced persistent threats leveraging Sliver.
IOC Summary
Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 191[.]101[.]131[.]244:40056 | botnet_cc | 2026-05-23 | 75% |
| ip:port | 191[.]101[.]131[.]244:31337 | botnet_cc | 2026-05-23 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["191.101.131.244"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["191.101.131.244"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Scheduled system backup using Veeam Backup & Replication
Filter/Exclusion: Exclude processes initiated by the veeam user or with backup in the command line arguments.
Scenario: Running PowerShell scripts for routine system monitoring via PowerShell ISE
Filter/Exclusion: Exclude processes with powershell_ise.exe or with ISE in the process name.
Scenario: Admin task to update Sliver-related tools via Chocolatey package manager
Filter/Exclusion: Exclude processes initiated by choco or with chocolatey in the command line.
Scenario: Legitimate use of Sliver for red team training within a secure lab environment
Filter/Exclusion: Exclude processes running from a known lab directory (e.g., C:\RedTeam\Sliver) or with a specific lab user account.
Scenario: Execution of Windows Task Scheduler jobs for log rotation or system cleanup
Filter/Exclusion: Exclude processes with schtasks.exe or with logrotate/clean in the command line arguments.