ThreatFox: Sliver IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Sliver implant to establish persistent command-and-control channels within the Azure environment, leveraging specific indicators of compromise such as unique network signatures and process artifacts. Proactive hunting for these IOCs is critical because early detection of Sliver’s sophisticated evasion capabilities allows the SOC team to disrupt lateral movement before the adversary fully embeds its modular payload across tenant workloads.

IOC Summary

Malware Family: Sliver Total IOCs: 7 IOC Types: ip:port, url, sha256_hash, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["144.208.127.243"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.208.127.243"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Sliver
let malicious_domains = dynamic(["secpopper.world", "catalapnews.today"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Sliver
let malicious_urls = dynamic(["https://feng-shui.ua/b/in.js", "https://feng-shui.ua/b/up.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Sliver
let malicious_hashes = dynamic(["8f708114c42c3ee145d51b0e698f787d249ca86345e5916ac554e750d6eac0c2"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Sliver IOCs detection rule, tailored for an enterprise environment where legitimate administrative activities often mimic Sliver C2 behavior:

• Endpoint Management Software Updates (e.g., Microsoft Intune or SCCM)

  • Scenario: During scheduled maintenance windows, Endpoint Configuration Manager (SCCM) or Microsoft Intune agents push large software updates. These agents frequently utilize specific network ports and certificate chains that match the Sliver IOCs for encrypted C2 traffic, particularly when communicating with cloud-based update repositories. The process ccmexec.exe may spawn child processes that establish connections to IP ranges overlapping with known Sliver infrastructure.
  • Filter/Exclusion: Create an exclusion rule based on the parent process name (ccmexec.exe, intune-management-agent.exe) and restrict the match to specific destination IP subnets used by the enterprise’s update servers (e.g., *.update.microsoft.com or internal SCCM distribution points).

• Legacy Java-Based Application Servers

  • Scenario: Enterprise applications running on older Java versions (JRE 8/11) often initiate outbound connections to external APIs for reporting or data synchronization. These connections frequently utilize the specific TLS fingerprinting and User-Agent strings that Sliver IOCs monitor. A scheduled job within a legacy ERP system might trigger a burst of traffic from java.exe processes, mimicking the beaconing behavior of a Sliver implant.
  • Filter/Exclusion: Exclude alerts where the process image path contains \Program Files\Java\ or specific application paths (e.g., \Oracle\Middleware\) and the destination port is standard web traffic (443) but the User-Agent header matches known internal Java clients rather than generic browser strings.

• Automated Backup and Disaster Recovery Agents

  • Scenario: Scheduled backup jobs