ThreatFox: Sliver IOCs

Hunt Hypothesis

This hypothesis detects adversary activity involving the Sliver C2 framework by identifying specific indicators of compromise that signal potential command and control communications or post-exploitation tool deployment within the network. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify early-stage intrusions leveraging this advanced, modular C2 platform before adversaries establish persistent access or exfiltrate sensitive data.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["185.112.147.233"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.112.147.233"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Sliver IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often perform scheduled deep scans or heuristic checks that generate network traffic and process execution patterns mimicking Sliver’s command-and-control (C2) behavior. These scans may trigger the specific IOCs associated with Sliver’s beaconing intervals or payload signatures.
  • Filter/Exclusion: Create a filter to exclude alerts originating from known EDR service accounts (e.g., SYSTEM, LocalService) and processes matching the EDR agent executable names (e.g., C:\Program Files\CrowdStrike\fs.exe or C:\Windows\System32\MsMpEng.exe). Additionally, correlate with the scheduled task name in Windows Task Scheduler to exclude runs occurring during defined maintenance windows.

• Scenario: Software Deployment via Configuration Management Tools

  • Context: IT administrators using tools like Microsoft SCCM (Configuration Manager), Ansible, or Puppet frequently push software updates or configuration scripts that involve downloading payloads and establishing persistent connections. The network signatures of these deployment agents often overlap with Sliver’s IOCs, particularly regarding the specific User-Agent strings or TLS handshake patterns used by Sliver implants.
  • Filter/Exclusion: Implement an exclusion based on the source IP ranges of the internal Configuration Management infrastructure (e.g., SCCM Site Servers) and exclude alerts where the parent process is a known deployment agent (e.g., ccmsetup.exe, ansible-playbook). A specific filter can be applied to ignore traffic initiated by these agents during standard business hours or defined deployment windows.

• Scenario: Internal DevOps CI/CD Pipeline Artifacts

  ---