ThreatFox: Sliver IOCs

Hunt Hypothesis

The ThreatFox: Sliver IOCs rule detects potential adversary activity associated with the Sliver C2 framework by identifying known malicious indicators linked to its infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromise attempts by advanced persistent threats leveraging Sliver.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["46.8.226.70"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.8.226.70"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

• Scenario: Scheduled system integrity check using PowerShell to verify file hashes
  Filter/Exclusion: ProcessName != "powershell.exe" OR CommandLine NOT LIKE '%Get-FileHash%'

• Scenario: Sliver is being used legitimately by the red team for authorized penetration testing
  Filter/Exclusion: ProcessName == "sliver.exe" OR User == "redteam_user"

• Scenario: Windows Task Scheduler runs a legitimate script that downloads a file from a known internal server
  Filter/Exclusion: DestinationIP IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)

• Scenario: Windows Update or Group Policy deployment triggers a script that uses Sliver for remote management
  Filter/Exclusion: ProcessName == "wmic.exe" OR CommandLine LIKE '%GroupPolicy%'

• Scenario: Microsoft Defender ATP or Windows Defender runs a scan that uses PowerShell to analyze files
  Filter/Exclusion: ProcessName == "MsMpEng.exe" OR CommandLine LIKE '%Scan'