ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of Sliver implant indicators, a popular open-source C2 framework frequently used by adversaries for post-compromise lateral movement and persistent access. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the attacker can establish a stable command-and-control channel or escalate privileges.

IOC Summary

Malware Family: Sliver Total IOCs: 11 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`209[.]99[.]190[.]104:31337`	botnet_cc	2026-09-06	75%
ip:port	`23[.]254[.]130[.]234:31337`	botnet_cc	2026-09-06	75%
ip:port	`207[.]56[.]20[.]199:31337`	botnet_cc	2026-09-06	75%
ip:port	`45[.]9[.]149[.]229:31337`	botnet_cc	2026-09-06	75%
ip:port	`177[.]3[.]40[.]23:31337`	botnet_cc	2026-09-06	75%
ip:port	`2[.]56[.]118[.]107:31337`	botnet_cc	2026-09-06	75%
ip:port	`66[.]179[.]31[.]191:31337`	botnet_cc	2026-09-06	75%
ip:port	`85[.]137[.]58[.]194:31337`	botnet_cc	2026-09-06	75%
ip:port	`89[.]19[.]220[.]70:4443`	botnet_cc	2026-09-06	75%
ip:port	`91[.]92[.]47[.]160:37773`	botnet_cc	2026-09-06	75%
ip:port	`125[.]82[.]240[.]181:13357`	botnet_cc	2026-09-06	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["85.137.58.194", "89.19.220.70", "91.92.47.160", "209.99.190.104", "23.254.130.234", "66.179.31.191", "45.9.149.229", "125.82.240.181", "207.56.20.199", "2.56.118.107", "177.3.40.23"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["85.137.58.194", "89.19.220.70", "91.92.47.160", "209.99.190.104", "23.254.130.234", "66.179.31.191", "45.9.149.229", "125.82.240.181", "207.56.20.199", "2.56.118.107", "177.3.40.23"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Scenario: A DevOps engineer uses the sliver-client binary during a quarterly red team exercise or internal penetration test to validate network segmentation.
- Filter/Exclusion: Exclude hosts tagged with RedTeam or PenTest in your asset inventory, or whitelist specific user accounts (e.g., svc-redteam, jdoe-pentest) when the IOC hash matches known Sliver client versions.
Scenario: A security engineer downloads the Sliver client to a jump box or bastion host to generate new IOCs or test detection coverage in a staging environment.
- Filter/Exclusion: Exclude hosts within the Staging or Lab subnets, or filter by process path if the binary is stored in a dedicated tooling directory like C:\Tools\Sliver\ or /opt/sliver/.
Scenario: An automated CI/CD pipeline or build agent pulls the Sliver client as part of a security scanning suite or container image build process (e.g., inside a Docker build context or a GitHub Actions runner).
- Filter/Exclusion: Exclude processes running under service accounts associated with CI/CD (e.g., github-actions, jenkins, azure-pipelines) or exclude containerized workloads where the IOC is detected within a container image layer rather than the host filesystem.
Scenario: A system administrator uses Sliver’s sliver-server component in a temporary sandbox to test C2 beacon configurations before deploying to production.
- Filter/Exclusion: Whitelist the specific user account performing the test (e.g., admin-sandbox) and limit the exclusion to a specific time window or IP range associated with the sandbox environment.
Scenario: A security team maintains a local copy of the Sliver client in a shared network drive (e.g