ThreatFox: Havoc IOCs

Hunt Hypothesis

This hunt targets the presence of specific IOCs linked to the Havoc framework, a post-exploitation tool frequently used by adversaries for command and control and payload execution. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or active C2 channels before attackers can establish persistence or escalate privileges.

IOC Summary

Malware Family: Havoc Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["5.163.239.119", "38.242.209.29", "109.205.212.241"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.163.239.119", "38.242.209.29", "109.205.212.241"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Havoc

False Positive Guidance

• Scenario: A DevOps team uses a custom PowerShell script to deploy configuration files to a fleet of Windows servers, where the script writes a specific hash or filename pattern (e.g., update_config.ps1 or a specific SHA256) that matches one of the Havoc IOCs.
  • Filter/Exclusion: Exclude events where the parent process is powershell.exe or pwsh.exe and the command line contains known deployment keywords like -File, -Command, or specific script paths (e.g., C:\Scripts\Deploy\).
• Scenario: An IT administrator runs a legitimate backup utility (e.g., Veeam, Commvault, or Windows Server Backup) that creates temporary files or logs with a name or hash that coincidentally matches a Havoc IOC.
  • Filter/Exclusion: Exclude events where the parent process is a known backup agent (e.g., vssadmin.exe, wbadmin.exe, commvault_agent.exe) or where the file path resides in standard backup directories (e.g., C:\Program Files\Commvault\, C:\Veeam\).
• Scenario: A security team performs a scheduled vulnerability scan or integrity check using a tool like Tenable Nessus or Qualys, which may drop temporary probe files or execute small binaries that match Havoc IOCs.
  • Filter/Exclusion: Exclude events where the parent process is a known scanner agent (e.g., nessus_agent.exe, qualys_agent.exe) or where the event occurs during a scheduled maintenance window (e.g., between 02:00–04:00 AM) and the user account is a service account (e.g., svc_scanner, DOMAIN\scanner_admin).
• Scenario: A developer or QA engineer runs a local test application or a CI