ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the Sliver C2 framework by identifying specific indicators of compromise such as unique process executions and network connections associated with its known infrastructure. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage post-compromise operations, enabling timely containment before the adversary establishes persistent command-and-control channels within the environment.

IOC Summary

Malware Family: Sliver Total IOCs: 12 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`43[.]132[.]172[.]28:31337`	botnet_cc	2026-08-22	75%
ip:port	`195[.]10[.]226[.]239:31337`	botnet_cc	2026-08-22	75%
ip:port	`109[.]236[.]50[.]134:31337`	botnet_cc	2026-08-22	75%
ip:port	`185[.]251[.]91[.]177:31337`	botnet_cc	2026-08-22	75%
ip:port	`8[.]211[.]194[.]92:41076`	botnet_cc	2026-08-22	75%
ip:port	`89[.]125[.]50[.]200:31337`	botnet_cc	2026-08-22	75%
ip:port	`193[.]109[.]78[.]102:31337`	botnet_cc	2026-08-22	75%
ip:port	`152[.]53[.]187[.]147:58173`	botnet_cc	2026-08-22	75%
ip:port	`185[.]43[.]5[.]225:31337`	botnet_cc	2026-08-22	75%
ip:port	`203[.]159[.]90[.]24:59407`	botnet_cc	2026-08-22	75%
ip:port	`195[.]177[.]94[.]87:31337`	botnet_cc	2026-08-22	75%
ip:port	`45[.]74[.]3[.]184:31337`	botnet_cc	2026-08-22	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["152.53.187.147", "195.10.226.239", "195.177.94.87", "45.74.3.184", "89.125.50.200", "203.159.90.24", "109.236.50.134", "43.132.172.28", "193.109.78.102", "185.43.5.225", "185.251.91.177", "8.211.194.92"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["152.53.187.147", "195.10.226.239", "195.177.94.87", "45.74.3.184", "89.125.50.200", "203.159.90.24", "109.236.50.134", "43.132.172.28", "193.109.78.102", "185.43.5.225", "185.251.91.177", "8.211.194.92"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Sliver IOCs rule, including targeted filters and exclusions tailored for an enterprise environment:

Scenario: Automated Patching via WSUS or SCCM
- Context: The Sliver C2 framework often utilizes specific HTTP/HTTPS User-Agent strings and TLS fingerprint patterns (JA3) that can overlap with legitimate patch management tools. When the Microsoft Endpoint Configuration Manager (SCCM) or Windows Server Update Services (WSUS) agents communicate with upstream update servers, they may trigger IOCs related to Sliver’s beaconing behavior or specific certificate hashes.
- Filter/Exclusion: Exclude traffic originating from the System account on known SCCM/WSUS server FQDNs (e.g., *.scm.corp.local) where the destination port is 80, 443, or 8531, and the process name matches WUAUService.exe or ccmsetup.exe.
Scenario: Scheduled Backup Jobs using Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault frequently establish long-lived connections to cloud storage repositories (AWS S3, Azure Blob) or on-premises deduplication engines. These agents often employ custom TLS configurations and specific HTTP headers that mimic the Sliver IOCs regarding connection duration and payload structure.
- Filter/Exclusion: Create a rule exclusion for processes named VeeamAgent.exe or CommServe.exe running under the context of scheduled tasks (e.g., Task Name: “Nightly Backup Job”) communicating with whitelisted backup repository IP ranges, specifically filtering out alerts where the destination port is 9443 or 8080.
**Scenario: Cloud