ThreatFox: Sliver IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving known Sliver C2 framework indicators to uncover potential command and control communications or initial access attempts within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because Sliver’s modular design allows attackers to evade standard signature-based defenses, necessitating early identification of its unique behavioral patterns to prevent lateral movement and data exfiltration.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["45.125.67.196"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.125.67.196"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Sliver IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: The organization uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push updates. A scheduled job running msiexec or a custom PowerShell script (Install-SliverAgent.ps1) during off-hours may download and execute a legitimate Sliver C2 agent binary that matches the rule’s IOCs, triggering an alert on every deployment cycle.
  • Suggested Filter: Exclude events where the parent process is ccmsetup.exe, msiexec.exe, or powershell.exe running under the context of a known service account (e.g., DOMAIN\SCCM-Deploy-Svc) and occurring within the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Internal DevOps Pipeline Execution

  • Context: The internal CI/CD pipeline (utilizing Jenkins or GitLab Runners) spins up temporary containers to build and test applications. These runners often utilize Sliver as a lightweight C2 framework for internal telemetry and agent management. When the pipeline executes a “build” stage, it spawns Sliver processes that match the threat IOCs but are part of standard development workflows.
  • Suggested Filter: Create an exclusion based on source IP ranges associated with the DevOps cluster (e.g., 10.20.30.0/24) and filter out alerts where the user context is a non-interactive service account named gitlab-runner or jenkins-agent.

• Scenario: Endpoint Security Agent Health Checks

  • Context: The enterprise’s primary EDR solution (e.g., CrowdStrike Falcon