ThreatFox: Havoc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Havoc post-exploitation tool, which is frequently used by threat actors for lateral movement and command execution within compromised networks. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly detect early-stage intrusions and mitigate potential data exfiltration or privilege escalation attacks before they spread across the environment.

IOC Summary

Malware Family: Havoc Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`172[.]239[.]45[.]42:80`	botnet_cc	2026-07-23	75%
ip:port	`200[.]234[.]219[.]26:80`	botnet_cc	2026-07-23	100%
ip:port	`200[.]234[.]219[.]26:443`	botnet_cc	2026-07-23	100%
ip:port	`200[.]234[.]219[.]26:22`	botnet_cc	2026-07-23	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["200.234.219.26", "172.239.45.42"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["200.234.219.26", "172.239.45.42"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Havoc

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding filters for the ThreatFox: Havoc IOCs detection rule in an enterprise environment:

Scenario: Security Tooling Updates and Signature Synchronization
- Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or SIEM connectors frequently download threat intelligence feeds that include the specific IOCs associated with Havoc. These tools often generate network traffic to known ThreatFox endpoints during scheduled signature updates.
- Filter/Exclusion: Exclude network connections where the source process is a recognized security agent (e.g., FalconSensor.exe, MsMpEng.exe) and the destination IP matches the internal update server or the specific ThreatFox feed endpoint used by your organization.
Scenario: Scheduled Vulnerability Scanning Jobs
- Context: Automated vulnerability management tools like Tenable Nessus, Qualys, or Rapid7 InsightVM run nightly scans against the corporate network. These scanners often probe external intelligence databases to cross-reference asset vulnerabilities, triggering connections that match Havoc IOCs within their scan logic.
- Filter/Exclusion: Create an exclusion based on source IP ranges assigned to the vulnerability management cluster (e.g., 10.20.50.x) and restrict the rule trigger to non-scan hours or specific service accounts used by these tools (e.g., svc-tenable, qualys-agent).
Scenario: Admin-Led Threat Intelligence Research
- Context: Security analysts or system administrators manually query external threat intelligence platforms (such as VirusTotal, Hybrid Analysis, or internal SOAR dashboards) to investigate specific alerts. During these manual lookups, the analyst’s workstation may initiate connections that align with Havoc IOCs while fetching detailed reports.
- Filter/Exclusion: Exclude traffic originating