ThreatFox: Sliver IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing the Sliver implant to establish persistent command-and-control channels within the network, evidenced by specific threat indicators. Proactive hunting in Azure Sentinel is critical to rapidly identify and isolate these high-severity artifacts before they can exfiltrate sensitive data or pivot laterally across cloud resources.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["103.212.187.217"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.212.187.217"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Sliver IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Engine Updates

  • Scenario: The organization’s EDR agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) performs a scheduled signature update that downloads and executes a temporary installer containing Sliver-specific hash values. This is often triggered by the msiexec or svchost.exe process during off-hours maintenance windows.
  • Filter/Exclusion: Create an exclusion for processes originating from known EDR installation paths (e.g., C:\Program Files\CrowdStrike\*) and restrict the rule to trigger only if the parent process is not a trusted system service or installer executable.

• Software Deployment via SCCM or Intune

  • Scenario: The IT Operations team deploys a new internal application (e.g., a custom HR portal client) using Microsoft Endpoint Configuration Manager (SCCM). The deployment package includes a Sliver-based telemetry module that generates network connections matching the IOCs during the initial rollout phase.
  • Filter/Exclusion: Exclude traffic and process execution originating from the specific SCCM Management Point server IP range or filter out events where the User Account is the local system account (NT AUTHORITY\SYSTEM) running under a known deployment job ID (e.g., JobID starting with “APP-DEPLOY”).

• Third-Party Backup Agent Execution

  • Scenario: An enterprise backup solution like Veeam Backup & Replication or Commvault runs its nightly agent service. The agent utilizes a Sliver-based communication channel to coordinate data transfer between the backup server and endpoints, triggering the IOC detection during the scheduled backup window (e.g., 02:00 – 04:00