This detection rule identifies adversary activity by matching network and host telemetry against sixteen specific Indicators of Compromise (IOCs) linked to the Sliver implant framework. A proactive hunt is essential in Azure Sentinel because Sliver’s modular design allows attackers to establish persistent command-and-control channels that often evade standard signature-based defenses, requiring continuous monitoring to detect early-stage compromises.
Malware Family: Sliver Total IOCs: 16 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 185[.]185[.]68[.]42:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 89[.]124[.]80[.]214:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 213[.]145[.]86[.]232:31866 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 45[.]142[.]141[.]186:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 188[.]42[.]217[.]40:64323 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 64[.]90[.]17[.]193:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 146[.]70[.]155[.]238:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 43[.]156[.]107[.]94:8887 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 156[.]224[.]28[.]23:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 199[.]217[.]98[.]55:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 31[.]76[.]111[.]38:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 45[.]153[.]34[.]164:61443 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 185[.]246[.]220[.]204:55448 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 185[.]132[.]54[.]254:8888 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 198[.]13[.]158[.]143:31337 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 153[.]75[.]82[.]143:31337 | botnet_cc | 2026-08-21 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["198.13.158.143", "188.42.217.40", "153.75.82.143", "146.70.155.238", "199.217.98.55", "45.142.141.186", "156.224.28.23", "185.185.68.42", "185.132.54.254", "64.90.17.193", "43.156.107.94", "213.145.86.232", "89.124.80.214", "31.76.111.38", "45.153.34.164", "185.246.220.204"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.13.158.143", "188.42.217.40", "153.75.82.143", "146.70.155.238", "199.217.98.55", "45.142.141.186", "156.224.28.23", "185.185.68.42", "185.132.54.254", "64.90.17.193", "43.156.107.94", "213.145.86.232", "89.124.80.214", "31.76.111.38", "45.153.34.164", "185.246.220.204"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: Sliver IOCs rule, along with targeted filtering strategies suitable for an enterprise environment:
Scenario: Automated Vulnerability Scanning by Tenable Nessus
beacon communication intervals).NessusAgent.exe) and User Account (NT SERVICE\TenableScanner). Additionally, exclude traffic originating from the dedicated IP range of the vulnerability scanning server (e.g., 10.20.50.10/32).Scenario: Scheduled PowerShell Backup Job via Microsoft System Center Configuration Manager (SCCM)
SCCM_Backup_Job) and the Parent Process (ccmexec.exe). Ensure the filter validates that the script path matches the known SCCM installation directory (e.g., C:\Program Files (x86)\Microsoft Configuration Manager\).Scenario: Endpoint Detection and Response (EDR) Telemetry from CrowdStrike Falcon