The ThreatFox: Havoc IOCs rule detects potential adversary activity linked to the Havoc malware family by identifying known malicious indicators associated with its command and control infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromises from advanced persistent threats leveraging Havoc.
IOC Summary
Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 202[.]73[.]4[.]137:8443 | botnet_cc | 2026-06-09 | 75% |
| ip:port | 182[.]255[.]82[.]121:80 | botnet_cc | 2026-06-09 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["182.255.82.121", "202.73.4.137"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["182.255.82.121", "202.73.4.137"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Scheduled system backup using Veeam
Filter/Exclusion: Exclude processes initiated by veeam.exe or with command lines containing backup or snapshot.
Scenario: Regularly executed PowerShell script for log management using Logstash
Filter/Exclusion: Exclude processes with logstash.exe or command lines containing logstash or pipeline.
Scenario: Administrative task to update software using SCCM (System Center Configuration Manager)
Filter/Exclusion: Exclude processes with ccmexec.exe or command lines containing SCCM, update, or patch.
Scenario: Use of Windows Task Scheduler to run maintenance scripts
Filter/Exclusion: Exclude processes launched via schtasks.exe or with command lines containing schtasks or scheduled.
Scenario: Legitimate use of Docker for container orchestration
Filter/Exclusion: Exclude processes with dockerd.exe or command lines containing docker, run, or container.