This hypothesis targets the presence of known indicators of compromise associated with the Havoc framework, which adversaries use to establish command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, mitigating the risk of persistent access and lateral movement before the adversary can escalate privileges or exfiltrate data.
Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 38[.]60[.]136[.]202:443 | botnet_cc | 2026-09-21 | 75% |
| ip:port | 13[.]140[.]145[.]33:443 | botnet_cc | 2026-09-21 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["13.140.145.33", "38.60.136.202"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["13.140.145.33", "38.60.136.202"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate Use of Havoc Framework in DevOps/Security Teams: Security engineers or red teamers may use the Havoc framework (often via its C2 server or client) in isolated lab environments or staging networks to test application resilience or develop custom payloads.
SecOps-RedTeam) or where the process havoc.exe/c2.exe is launched from a known development directory (e.g., C:\dev\havoc\) rather than standard temp or system directories.Scheduled Backup or Sync Jobs Using Havoc-Associated Binaries: Some legacy or custom backup solutions might bundle or invoke binaries that share the same hash or name as the IOCs if they are repackaged or if the IOC is a generic filename like update.exe or sync.exe (common in Havoc implant naming conventions).
VeeamAgent.exe, BackupExec32.exe, or rsync.exe) and the working directory matches a configured backup storage path (e.g., D:\Backups\).Software Update Mechanisms Reusing Common IOC Filenames: If the IOCs include common filenames like install.exe or setup.exe (sometimes used by Havoc implants to disguise themselves), standard software update tools like Chocolatey, SCCM, or vendor-specific updaters may trigger the rule.
choco.exe, ccmexec.exe, msiexec.exe) and the command line contains typical update flags (e.g., /install, /update, or `—silent