ThreatFox: Sliver IOCs

Hunt Hypothesis

This hypothesis targets the presence of Sliver implant indicators, a popular open-source C2 framework frequently used by adversaries for post-compromise operations such as lateral movement and privilege escalation. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, particularly when standard telemetry may miss the low-and-slow traffic patterns characteristic of Sliver sessions.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["68.178.202.150", "68.178.205.17"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["68.178.202.150", "68.178.205.17"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

• Sliver Implant Used for Internal Penetration Testing or Red Team Exercises

  • Scenario: A Red Team or internal security assessment team deploys Sliver implants on specific test servers to simulate a compromise and validate detection coverage. The implant’s unique hash or network beacon matches the ThreatFox IOCs.
  • Filter/Exclusion: Exclude alerts where the source process is launched by a known Red Team tool (e.g., Cobalt Strike, Metasploit, or a custom redteam_runner.exe) or where the user account belongs to the RedTeam AD group. Alternatively, maintain a whitelist of specific hostnames or IP ranges designated for testing.

• Sliver Implant Bundled with a Third-Party Application or Installer

  • Scenario: A software vendor bundles a Sliver-based implant (or a component with a matching hash) within a large enterprise application installer (e.g., a specific version of Adobe Creative Cloud or VMware Workstation installer). During a mass deployment via SCCM or Intune, the implant is extracted and executed, triggering the IOC match.
  • Filter/Exclusion: Correlate the alert with the parent process. If the parent process is a known deployment agent (e.g., CCMSetup.exe, IntuneAgent.exe, or msiexec.exe) and the file path resides in a standard application directory (e.g., C:\Program Files\), suppress the alert.

• Sliver Implant Used for Automated Health Checks or Synthetic Monitoring

  • Scenario: An IT operations team uses a lightweight Sliver implant as a persistent agent for synthetic monitoring or health checks on critical infrastructure nodes. The implant runs as a scheduled task or service, and its beaconing behavior or file hash matches the IOCs.
  • Filter/Exclusion: Exclude alerts where