ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This rule detects the presence of Sliver post-exploitation malware, which adversaries deploy to establish persistent access, execute arbitrary commands, and exfiltrate sensitive data following initial compromise. Proactively hunting for these IOCs in Azure Sentinel is critical to identify hidden footholds and lateral movement activities before the threat actor can fully establish control or exfiltrate critical assets.

IOC Summary

Malware Family: Sliver Total IOCs: 60 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`94[.]237[.]62[.]102:31337`	botnet_cc	2026-09-27	50%
ip:port	`94[.]154[.]43[.]217:31337`	botnet_cc	2026-09-27	50%
ip:port	`94[.]103[.]2[.]70:31337`	botnet_cc	2026-09-27	50%
ip:port	`91[.]199[.]32[.]35:31337`	botnet_cc	2026-09-27	50%
ip:port	`89[.]125[.]50[.]85:31337`	botnet_cc	2026-09-27	50%
ip:port	`89[.]106[.]83[.]214:31337`	botnet_cc	2026-09-27	50%
ip:port	`82[.]29[.]53[.]100:31337`	botnet_cc	2026-09-27	50%
ip:port	`84[.]247[.]191[.]49:31337`	botnet_cc	2026-09-27	50%
ip:port	`82[.]25[.]63[.]33:31337`	botnet_cc	2026-09-27	50%
ip:port	`81[.]17[.]100[.]251:31337`	botnet_cc	2026-09-27	50%
ip:port	`79[.]137[.]77[.]63:31337`	botnet_cc	2026-09-27	50%
ip:port	`77[.]42[.]75[.]230:31337`	botnet_cc	2026-09-27	50%
ip:port	`74[.]0[.]42[.]242:4443`	botnet_cc	2026-09-27	50%
ip:port	`64[.]23[.]254[.]205:31337`	botnet_cc	2026-09-27	50%
ip:port	`66[.]42[.]33[.]224:31337`	botnet_cc	2026-09-27	50%
ip:port	`62[.]69[.]131[.]43:31337`	botnet_cc	2026-09-27	50%
ip:port	`46[.]19[.]140[.]40:31337`	botnet_cc	2026-09-27	50%
ip:port	`45[.]74[.]36[.]153:31337`	botnet_cc	2026-09-27	50%
ip:port	`45[.]197[.]12[.]215:31337`	botnet_cc	2026-09-27	50%
ip:port	`45[.]38[.]20[.]103:31337`	botnet_cc	2026-09-27	50%
ip:port	`45[.]125[.]67[.]3:31337`	botnet_cc	2026-09-27	50%
ip:port	`43[.]173[.]13[.]35:31337`	botnet_cc	2026-09-27	50%
ip:port	`43[.]163[.]208[.]239:31337`	botnet_cc	2026-09-27	50%
ip:port	`42[.]112[.]213[.]93:31337`	botnet_cc	2026-09-27	50%
ip:port	`24[.]144[.]71[.]145:31337`	botnet_cc	2026-09-27	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["147.50.242.137", "210.16.67.195", "162.33.178.10", "46.19.140.40", "94.154.43.217", "192.253.248.18", "43.173.13.35", "89.125.50.85", "166.88.77.149", "38.60.125.189", "91.199.32.35", "45.125.67.3", "129.204.144.48", "82.29.53.100", "77.42.75.230", "66.42.33.224", "193.149.129.2", "184.107.160.151", "138.16.183.115", "24.144.71.145", "82.25.63.33", "198.144.183.169", "62.69.131.43", "64.23.254.205", "180.94.20.228", "185.223.252.36", "156.240.236.11", "154.219.101.56", "142.93.58.98", "163.53.219.180", "42.112.213.93", "84.247.191.49", "187.145.61.38", "103.238.235.171", "168.110.125.3", "146.59.63.41", "194.226.187.161", "43.163.208.239", "89.106.83.214", "81.17.100.251", "45.74.36.153", "210.16.65.229", "158.178.225.215", "94.103.2.70", "45.197.12.215", "163.53.219.87", "94.237.62.102", "104.223.75.156", "146.19.125.102", "157.254.167.106"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["147.50.242.137", "210.16.67.195", "162.33.178.10", "46.19.140.40", "94.154.43.217", "192.253.248.18", "43.173.13.35", "89.125.50.85", "166.88.77.149", "38.60.125.189", "91.199.32.35", "45.125.67.3", "129.204.144.48", "82.29.53.100", "77.42.75.230", "66.42.33.224", "193.149.129.2", "184.107.160.151", "138.16.183.115", "24.144.71.145", "82.25.63.33", "198.144.183.169", "62.69.131.43", "64.23.254.205", "180.94.20.228", "185.223.252.36", "156.240.236.11", "154.219.101.56", "142.93.58.98", "163.53.219.180", "42.112.213.93", "84.247.191.49", "187.145.61.38", "103.238.235.171", "168.110.125.3", "146.59.63.41", "194.226.187.161", "43.163.208.239", "89.106.83.214", "81.17.100.251", "45.74.36.153", "210.16.65.229", "158.178.225.215", "94.103.2.70", "45.197.12.215", "163.53.219.87", "94.237.62.102", "104.223.75.156", "146.19.125.102", "157.254.167.106"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Legitimate Red Team/Blue Team Engagement: During authorized penetration testing or incident response exercises, security teams may deploy Sliver implants to simulate attacker behavior and validate detection coverage.
- Filter/Exclusion: Exclude processes running from specific known test directories (e.g., C:\RedTeam\Tools\Sliver\) or filter by parent process names associated with orchestration tools like Cobalt Strike or Metasploit when the host is tagged as a “Test Environment” in CMDB.
Developer Local Testing: Developers working on Go-based applications or reverse proxy configurations might use Sliver’s sliver-server or sliver-client binaries locally for unit testing or integration testing of C2 communication logic.
- Filter/Exclusion: Exclude hosts where the user account belongs to the dev-team AD group and the process path resides within standard development workspace directories (e.g., C:\Users\<user>\go\bin\ or C:\Projects\sliver-test\).
CI/CD Pipeline Artifacts: In containerized build pipelines, Sliver binaries might be pulled as dependencies or test fixtures for security scanning jobs (e.g., SAST/DAST tools that include Sliver as a sample payload for validation).
- Filter/Exclusion: Exclude events where the parent process is a known CI/CD agent (e.g., jenkins-agent, gitlab-runner, azure-pipelines-agent) and the file hash matches a known baseline of Sliver test artifacts stored in the internal artifact registry.
Legacy Application Maintenance: Some legacy internal applications or custom middleware may embed Sliver-like C2 logic or use Sliver’s Go library components for internal service mesh communication, leading to false positives on process creation or network connections.
- Filter/Exclusion: Exclude specific service accounts (e.g