The ThreatFox: Havoc IOCs rule detects potential adversary activity linked to the Havoc malware family by identifying known malicious indicators associated with its infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromises from advanced persistent threats.
IOC Summary
Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 185[.]190[.]142[.]121:8443 | botnet_cc | 2026-06-15 | 75% |
| ip:port | 20[.]224[.]219[.]169:80 | botnet_cc | 2026-06-15 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["20.224.219.169", "185.190.142.121"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["20.224.219.169", "185.190.142.121"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Scheduled system backup using Veeam Backup & Replication
Filter/Exclusion: Exclude processes initiated by the Veeam service or with command-line arguments containing backup or restore.
Scenario: Administrative task using PowerShell to manage Active Directory users
Filter/Exclusion: Exclude processes with PowerShell.exe and command-line arguments containing AD or dsquery.
Scenario: Regular log rotation using logrotate on a Linux server
Filter/Exclusion: Exclude processes with logrotate in the command line or associated with the logrotate service.
Scenario: Database maintenance job using SQL Server Agent
Filter/Exclusion: Exclude processes with sqlservr.exe or command-line arguments containing sqlagent or maintenance.
Scenario: Software update deployment using Chocolatey package manager
Filter/Exclusion: Exclude processes with choco.exe and command-line arguments containing install, update, or upgrade.