ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving known Sliver implant indicators of compromise (IOCs) that signal active command-and-control communications or lateral movement within the network. Proactively hunting for these specific signatures in Azure Sentinel is critical to rapidly isolate and remediate sophisticated post-exploitation threats before they establish persistent footholds.

IOC Summary

Malware Family: Sliver Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]61[.]149[.]187:31337`	botnet_cc	2026-07-12	75%
ip:port	`45[.]61[.]149[.]187:8004`	botnet_cc	2026-07-12	75%
ip:port	`45[.]61[.]149[.]187:8005`	botnet_cc	2026-07-12	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["45.61.149.187"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.61.149.187"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Sliver IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Management Agent Updates
- Scenario: The organization uses Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons. During scheduled maintenance windows, these agents push updates to the underlying Sliver C2 framework components on jump servers. This generates legitimate network connections and file modifications matching the Sliver IOCs as part of a standard patching routine.
- Filter/Exclusion: Exclude traffic originating from known management server IP ranges (e.g., 10.50.10.0/24) or filter events where the process name is ccmexec.exe or IvantiAgentService.exe.
Internal DevOps Pipeline Execution
- Scenario: The engineering team utilizes Jenkins or GitLab CI/CD runners hosted on-premise. These pipelines often include a stage that validates the integrity of internal security tools by running a “Sliver health check” script against the C2 beacon infrastructure, triggering the exact IOCs defined in the rule during build deployments.
- Filter/Exclusion: Create an exclusion for hosts belonging to the DevOps-Runners Active Directory Security Group or filter events where the parent process is java.exe (Jenkins) or gitlab-runner.exe.
Scheduled Vulnerability Scanning
- Scenario: The enterprise runs a nightly vulnerability assessment using Tenable Nessus or Qualys. These scanners actively probe internal assets to verify the presence and version of security agents. When scanning the Sliver C2 servers, the scanner’s probing activity mimics the specific IOCs (such as specific registry key accesses or network handshakes)