ThreatFox: Sliver IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving Sliver C2 framework indicators to uncover potential post-exploitation command and control communications. Proactively hunting for these specific IOCs in Azure Sentinel is critical because Sliver’s modular design allows attackers to evade standard signature-based defenses, necessitating a targeted search to confirm early-stage compromise before lateral expansion occurs.

IOC Summary

Malware Family: Sliver Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["185.112.147.233"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.112.147.233"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Sliver

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Sliver IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Vulnerability Scanning with Sliver Frameworks

  • Context: Internal security teams often utilize custom or third-party vulnerability scanners (e.g., Tenable Nessus, Qualys) that deploy lightweight agents using the Sliver C2 framework for asset discovery and patch management. These agents periodically beacon to internal collectors, matching the rule’s IOCs.
  • Filter/Exclusion: Exclude traffic originating from specific internal IP ranges dedicated to the vulnerability scanning infrastructure (e.g., 10.50.20.x) or filter by process name if the agent is identified as TenableAgent.exe or QualysPC.exe.

• Scenario: DevOps Pipeline Artifact Deployment

  • Context: CI/CD pipelines (such as Jenkins, GitLab Runner, or Azure DevOps) frequently use Sliver-based agents to deploy microservices and container images. During the deployment phase, these runners execute network calls that mimic Sliver C2 communication patterns to fetch artifacts from internal registries.
  • Filter/Exclusion: Create an exclusion for processes running within the C:\Program Files\Jenkins or D:\GitLab\runner directories, specifically targeting user accounts named svc-ci-runner or azure-devops-agent.

• Scenario: Endpoint Detection and Response (EDR) Telemetry

  • Context: Modern EDR solutions (like CrowdStrike Falcon or Microsoft Defender for Endpoint) may utilize Sliver-compatible protocols for their own telemetry collection modules. When the EDR agent updates its policy definitions or uploads threat intelligence data, it triggers network signatures identical to the Sliver IOCs defined in the rule.
  • Filter/Exclusion: Exclude events where