ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving the Sliver C2 framework by monitoring for four specific Indicators of Compromise (IOCs) known to facilitate command and control communications. Proactively hunting for these IOCs in Azure Sentinel is critical because Sliver’s modular design allows attackers to evade traditional signature-based defenses, requiring active threat hunting to uncover stealthy lateral movement and data exfiltration attempts.

IOC Summary

Malware Family: Sliver Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]64[.]52[.]67:31337`	botnet_cc	2026-09-02	75%
ip:port	`213[.]111[.]149[.]152:55555`	botnet_cc	2026-09-02	75%
ip:port	`118[.]107[.]9[.]213:31337`	botnet_cc	2026-09-02	75%
ip:port	`118[.]107[.]9[.]233:31337`	botnet_cc	2026-09-02	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["213.111.149.152", "118.107.9.233", "118.107.9.213", "45.64.52.67"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["213.111.149.152", "118.107.9.233", "118.107.9.213", "45.64.52.67"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Sliver IOCs detection rule, along with targeted filters and exclusions:

Scenario: Legitimate deployment of the Sliver C2 framework by internal Red Team or Security Engineering groups during scheduled penetration testing.
- Context: The Red Team actively uses the open-source Sliver framework to simulate adversary behavior in a controlled environment, generating network traffic and file hashes that match the rule’s IOCs.
- Filter/Exclusion: Create an exclusion for the specific Red Team Jump Hosts (e.g., RED-TEAM-JMP01, RED-TEAM-JMP02) or filter based on a custom tag attribute (e.g., Environment=Test or Group=Security_Ops).
Scenario: Automated backup jobs utilizing Veeam Backup & Replication or Rubrik that generate specific hash signatures matching Sliver IOCs.
- Context: During nightly window, the backup service creates temporary executable files or network connections with hashes identical to known Sliver artifacts due to shared library dependencies or similar binary structures.
- Filter/Exclusion: Exclude traffic originating from the Backup Service Account (e.g., DOMAIN\svc_veeam) and filter by process name vrb.exe or Veeam.Backup.Service.exe.
Scenario: Execution of Microsoft Endpoint Configuration Manager (MECM) or Intune application deployment tasks.
- Context: The IT Operations team deploys a new security agent or utility tool that includes Sliver-compatible components, triggering the detection when the installer writes specific registry keys or network connections during the installation phase.
- Filter/Exclusion: Exclude events where the parent process is ccmsetup.exe (Configuration Manager) or `Int