ThreatFox: Sliver IOCs

Hunt Hypothesis

This rule detects the presence of Sliver, a popular open-source post-exploitation framework, by matching known Indicators of Compromise (IOCs) such as specific file hashes or network artifacts. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify persistent backdoors or command-and-control channels that adversaries may have established to maintain access and execute further post-exploitation activities.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["23.94.206.113"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.94.206.113"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

• Development Team Using Sliver for C2 Framework Testing

  • Scenario: Security engineers or red teamers use the Sliver client (sliver-client) and implant (sliver-implant) on staging or development servers to test new C2 configurations, beacon intervals, or transport layers (e.g., HTTP, WebSocket, DNS). The detection rule triggers on the presence of Sliver-specific binary names, hash values, or known IOCs (Indicators of Compromise) in the file system or process tree.
  • Filter/Exclusion: Exclude processes where the parent process is sliver-client.exe or sliver-server.exe, or exclude files located in specific development directories (e.g., C:\Dev\SliverTest\, C:\Users\<devuser>\Projects\Sliver\). Additionally, allowlist specific SHA-256 hashes of known internal Sliver builds used for testing.

• Red Team Engagement with Documented IOCs

  • Scenario: During a planned red team exercise, attackers deploy Sliver implants on target hosts. The detection rule fires because the implant matches known ThreatFox IOCs (e.g., specific file names like sliver.exe, beacon.dll, or unique memory patterns). This is a legitimate activity but generates a false positive if the engagement window is not properly communicated to the SOC.
  • Filter/Exclusion: Implement a time-based suppression or tag-based exclusion. If the host has a CMDB tag RedTeam_Active or if the alert timestamp falls within a pre-approved red team window (e.g., Start: 2024-05-01T09:00Z, End: 2024-05-01T17:00Z), suppress the alert. Alternatively, exclude alerts where the user context matches a