This hypothesis targets the presence of specific Indicators of Compromise (IOCs) linked to the Havoc framework, which adversaries frequently use to establish command-and-control channels or execute post-exploitation actions within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify potential Havoc-based intrusions early, mitigating the risk of persistent access and lateral movement before the adversary can fully compromise critical assets.
Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 51[.]222[.]87[.]92:8089 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 76[.]13[.]165[.]226:443 | botnet_cc | 2026-09-19 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["76.13.165.226", "51.222.87.92"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["76.13.165.226", "51.222.87.92"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses a custom Python script to perform automated network health checks or port scanning using the scapy library, which may generate traffic patterns or process behaviors matching Havoc’s C2 beaconing or specific IOCs (e.g., unusual outbound connections to non-standard ports).
python.exe or python3.exe and the command line contains keywords like health_check, ping, or scan, specifically if the destination IP is within the internal RFC1918 range or a known monitoring subnet.Scenario: An IT administrator runs a legacy backup utility or data migration tool that creates temporary files or uses specific memory allocation patterns that match one of the Havoc IOCs (e.g., specific file hashes or registry keys used for state tracking).
Veeam.exe, CommvaultAgent.exe, BackupExec.exe) and the file path resides in standard backup directories (e.g., C:\Backups\, D:\Archive\).Scenario: A software development team uses a local testing framework or emulator (such as Docker containers or VMs) that simulates network traffic or process execution, potentially triggering IOCs related to process injection or specific network signatures.
docker.exe, containerd-shim.exe) or virtual machine management tools (e.g., vmware-vmx.exe, VirtualBox.exe), particularly if the source IP is a known container bridge IP (e.g., 172.17.0.1).Scenario: A security team performs a controlled penetration test or red team exercise using Hav