ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving the Sliver C2 framework by monitoring for specific indicators of compromise such as unique process executions and network connections. Proactively hunting for these signals in Azure Sentinel is critical to rapidly detect early-stage post-exploitation operations and prevent potential lateral movement or data exfiltration before they escalate into a major incident.

IOC Summary

Malware Family: Sliver Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`89[.]213[.]118[.]199:31337`	botnet_cc	2026-07-28	75%
ip:port	`89[.]213[.]118[.]199:8080`	botnet_cc	2026-07-28	75%
ip:port	`89[.]213[.]118[.]199:8443`	botnet_cc	2026-07-28	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["89.213.118.199"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["89.213.118.199"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Here are the documented false positive scenarios for the ThreatFox: Sliver IOCs detection rule, including specific triggers and recommended filters:

Software Deployment via Endpoint Management Tools
- Scenario: Enterprise Endpoint Detection and Response (EDR) agents or configuration management tools like Microsoft Intune, SCCM (Configuration Manager), or Jamf frequently download Sliver-related binaries or scripts during routine patching cycles. These tools often utilize the same IOCs (hashes, file paths, or registry keys) that Sliver uses for its own agent communication, triggering a match when legitimate updates are pushed to workstations.
- Filter/Exclusion: Exclude processes originating from trusted management agents. Create a filter that ignores alerts where the parent process is ccmexec.exe (SCCM), MsMpEng.exe (Defender), or IntuneManagementExtension.exe, and restricts matches to specific known file paths within the %ProgramFiles% directory of these tools.
Scheduled Administrative Maintenance Jobs
- Scenario: IT operations teams utilize Windows Task Scheduler or PowerShell Scheduled Tasks to run nightly health checks, backup scripts, or inventory collection agents. If a scheduled task executes a PowerShell script that invokes the Sliver C2 beacon (often used internally for asset discovery) or references Sliver-specific registry keys, the detection logic will flag this as a potential threat.
- Filter/Exclusion: Implement an exclusion based on Task Name and User Context. Filter out alerts where the execution user is a known service account (e.g., DOMAIN\svc-backup) or SYSTEM, and the task name contains keywords such as “HealthCheck,” “Inventory,” or “PatchCycle.”
DevOps CI/CD Pipeline Artifacts
- Scenario: In environments with active DevOps practices,