ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Sliver C2 framework by monitoring specific indicators of compromise known to facilitate command and control communications within Azure Sentinel environments. Proactively hunting for these IOCs is critical because Sliver’s modular architecture allows attackers to establish persistent, stealthy footholds that can evade standard signature-based defenses if not actively sought out through threat intelligence-driven queries.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`166[.]88[.]95[.]90:5000`	botnet_cc	2026-08-30	75%
ip:port	`166[.]88[.]95[.]90:8080`	botnet_cc	2026-08-30	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["166.88.95.90"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["166.88.95.90"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Sliver IOCs detection rule in an enterprise environment:

Scenario: Automated Patch Deployment via WSUS/SCCM
- Context: During nightly maintenance windows, System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS) pushes updates to endpoints. The Sliver C2 beacon often utilizes specific HTTP headers and TLS fingerprints that can mimic the traffic patterns of legitimate patching agents communicating with update servers.
- Filter/Exclusion: Exclude traffic originating from the SCCM site server IP range (10.10.50.x) or WSUS servers where the destination port is 443 and the User-Agent string contains “Microsoft-Update” or “SCCM”.
Scenario: Scheduled Backup Jobs using Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled jobs that establish persistent connections to storage repositories. These agents often use custom TLS handshakes and specific IOCs (such as unique JAR signatures or certificate thumbprints) that overlap with Sliver’s known indicators, triggering the rule during high-volume backup windows.
- Filter/Exclusion: Create an exclusion for source hosts tagged with Role=BackupAgent communicating to destination IPs in the storage subnet (192.168.20.x). Additionally, filter out events occurring between 02:00 and 05:00 local time when backup jobs are active.
Scenario: Internal DevOps CI/CD Pipelines (Jenkins/GitLab)
- Context: Continuous Integration servers like Jenkins or GitLab Runners frequently execute build agents that download dependencies, pull images from private registries, and push artifacts. These processes often generate network traffic with IO