This hunt detects adversary activity involving the Sliver C2 framework by identifying network and host indicators associated with its specific infrastructure and execution patterns. Proactively hunting for these IOCs in Azure Sentinel is critical to uncover early-stage post-exploitation operations that may evade standard signature-based detections due to Sliver’s modular design and custom protocol capabilities.
Malware Family: Sliver Total IOCs: 28 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 203[.]12[.]31[.]141:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 193[.]124[.]130[.]25:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 54[.]46[.]17[.]182:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 104[.]233[.]251[.]191:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 49[.]7[.]54[.]75:32337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 95[.]216[.]144[.]182:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 213[.]165[.]37[.]30:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 185[.]207[.]105[.]80:8443 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 118[.]27[.]151[.]93:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 206[.]245[.]132[.]180:35333 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 45[.]227[.]255[.]111:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 46[.]8[.]236[.]121:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 103[.]67[.]184[.]198:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 47[.]91[.]30[.]143:40000 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 103[.]244[.]91[.]230:9444 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 20[.]205[.]136[.]20:65350 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 139[.]162[.]8[.]51:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 114[.]55[.]151[.]60:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 44[.]253[.]47[.]172:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 139[.]162[.]51[.]76:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 173[.]214[.]172[.]252:8443 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 104[.]171[.]136[.]217:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 153[.]76[.]116[.]156:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 173[.]212[.]223[.]160:31337 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 128[.]65[.]199[.]135:8899 | botnet_cc | 2026-08-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["47.91.30.143", "54.46.17.182", "114.55.151.60", "130.94.66.97", "153.76.116.156", "101.126.90.250", "185.207.105.80", "103.67.184.198", "139.162.51.76", "206.245.132.180", "144.208.127.223", "213.165.37.30", "193.124.130.25", "45.227.255.111", "173.214.172.252", "49.7.54.75", "44.253.47.172", "104.171.136.217", "103.244.91.230", "173.212.223.160", "20.205.136.20", "118.27.151.93", "128.65.199.135", "104.233.251.191", "95.216.144.182", "46.8.236.121", "139.162.8.51", "203.12.31.141"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.91.30.143", "54.46.17.182", "114.55.151.60", "130.94.66.97", "153.76.116.156", "101.126.90.250", "185.207.105.80", "103.67.184.198", "139.162.51.76", "206.245.132.180", "144.208.127.223", "213.165.37.30", "193.124.130.25", "45.227.255.111", "173.214.172.252", "49.7.54.75", "44.253.47.172", "104.171.136.217", "103.244.91.230", "173.212.223.160", "20.205.136.20", "118.27.151.93", "128.65.199.135", "104.233.251.191", "95.216.144.182", "46.8.236.121", "139.162.8.51", "203.12.31.141"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DevOps Pipeline Artifact Deployment
Sliver inventory management microservice to the production cluster. Since the service name matches the IOC string “Sliver,” the deployment process triggers the detection when the container image is pulled and executed by Kubernetes pods on worker nodes.10.20.50.0/24) or filter out events where the executable path contains /opt/ci-deploy/bin/sliver-inventory and the user context is a service account like svc-jenkins-runner.Scheduled Endpoint Health Check Job
Check-SliverStatus.ps1) that queries the local Sliver agent service, generating network connections and process creation events that match the Sliver IOC signatures.ProcessName is powershell.exe, the command line contains -ExecutionPolicy Bypass -File "C:\ProgramData\HealthChecks\Check-SliverStatus.ps1", and the parent process is TaskScheduler.exe.Third-Party RMM Agent Communication