ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving the Sliver C2 framework by monitoring for seven specific indicators of compromise that signal potential command and control communications or lateral movement. A proactive hunt is essential in Azure Sentinel to rapidly isolate these sophisticated threats before they establish persistence, given Sliver’s advanced evasion capabilities and high severity impact on enterprise networks.

IOC Summary

Malware Family: Sliver Total IOCs: 7 IOC Types: ip:port, domain

Type	Value	Threat Type	First Seen	Confidence
domain	`api.rh7.ninja`	botnet_cc	2026-08-20	100%
ip:port	`192[.]144[.]187[.]97:31337`	botnet_cc	2026-08-20	50%
ip:port	`14[.]103[.]50[.]128:31337`	botnet_cc	2026-08-20	50%
ip:port	`139[.]84[.]164[.]248:31337`	botnet_cc	2026-08-20	50%
ip:port	`94[.]154[.]32[.]18:31337`	botnet_cc	2026-08-20	50%
ip:port	`66[.]154[.]127[.]217:31337`	botnet_cc	2026-08-20	50%
ip:port	`185[.]245[.]182[.]240:31337`	botnet_cc	2026-08-20	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["192.144.187.97", "66.154.127.217", "94.154.32.18", "139.84.164.248", "185.245.182.240", "14.103.50.128"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.144.187.97", "66.154.127.217", "94.154.32.18", "139.84.164.248", "185.245.182.240", "14.103.50.128"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Sliver
let malicious_domains = dynamic(["api.rh7.ninja"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Sliver IOCs detection rule in an enterprise environment:

Scenario: Automated Software Patching via WSUS or SCCM
- Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS) agents often download and execute update packages. These processes frequently utilize the same network ports and file hashes that Sliver C2 beacons use for command and control.
- Filter/Exclusion: Create a rule exclusion based on the specific Process Name of the patching agent (e.g., ccmsetup.exe, wsusclient.exe) and restrict the detection to trigger only outside of defined maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Endpoint Detection & Response (EDR) Telemetry
- Context: EDR solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne constantly transmit telemetry data to their cloud consoles. The Sliver IOCs often match the specific HTTP User-Agent strings and destination IP ranges used by these EDR backends during routine health checks.
- Filter/Exclusion: Exclude traffic originating from known EDR service accounts (e.g., FALCON-AGENT, MsMpEng) or whitelist the specific set of public IP addresses belonging to the organization’s chosen EDR vendor’s cloud infrastructure.
Scenario: Scheduled Backup Jobs via Veeam or Commvault
- Context: Enterprise backup agents (such as Veeam Agent for Windows or CommCell) perform periodic data synchronization and integrity checks. These jobs often establish persistent connections to backup repositories that mimic the beaconing behavior of Sliver implants, triggering alerts on connection frequency and duration.
- **Filter/