ThreatFox: Sliver IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving the Sliver C2 framework by monitoring for seven specific indicators of compromise known to facilitate command and control communications. Proactive hunting in Azure Sentinel is critical because Sliver’s modular design allows attackers to evade traditional signature-based defenses, making early identification essential for containing potential lateral movement or data exfiltration.

IOC Summary

Malware Family: Sliver Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`209[.]97[.]166[.]99:80`	botnet_cc	2026-08-27	75%
ip:port	`172[.]93[.]187[.]109:13901`	botnet_cc	2026-08-27	75%
ip:port	`212[.]193[.]3[.]234:5678`	botnet_cc	2026-08-27	75%
ip:port	`35[.]229[.]230[.]203:21`	botnet_cc	2026-08-27	75%
ip:port	`158[.]160[.]98[.]75:31337`	botnet_cc	2026-08-27	75%
ip:port	`93[.]113[.]25[.]9:31337`	botnet_cc	2026-08-27	75%
ip:port	`139[.]162[.]82[.]104:38264`	botnet_cc	2026-08-27	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Sliver
let malicious_ips = dynamic(["35.229.230.203", "139.162.82.104", "172.93.187.109", "209.97.166.99", "93.113.25.9", "212.193.3.234", "158.160.98.75"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["35.229.230.203", "139.162.82.104", "172.93.187.109", "209.97.166.99", "93.113.25.9", "212.193.3.234", "158.160.98.75"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Sliver

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Sliver IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Enterprise Antivirus/EDR Scanning of Sliver Artifacts
- Context: Security tools like CrowdStrike Falcon, Microsoft Defender for Endpoint (MDE), or Carbon Black often perform deep file integrity checks on known binaries. If the organization has previously deployed a legitimate version of Sliver (e.g., for internal red teaming or asset management) and these EDR agents scan the associated hash, they may trigger the rule against their own scanning process.
- Filter/Exclusion: Exclude alerts where the process_name matches known EDR service executables (e.g., FalconSensor.exe, MsMpEng.exe) or where the parent_process is the EDR agent itself, provided the file hash matches a whitelisted internal Sliver build.
Scenario: Scheduled Red Team Engagement Scripts
- Context: Internal Security Operations teams frequently run automated red team exercises using Sliver C2 agents. These are often deployed via Windows Task Scheduler or Ansible Tower jobs that execute the Sliver beacon (sliver.exe) during maintenance windows (e.g., Saturday 02:00 AM). The detection logic may flag these scheduled executions as new threats.
- Filter/Exclusion: Create a filter excluding events where scheduled_task_name contains keywords like “RedTeam,” “SliverBeacon,” or “InternalC2” and the execution time falls within defined maintenance windows (e.g., 01:00–05:00 UTC).
Scenario: DevOps CI/CD Pipeline Artifact Deployment
- Context: In a DevSecOps environment,