This hunt targets known indicators of compromise associated with the Havoc framework, a popular post-exploitation tool used by adversaries for command and control and payload execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify active Havoc deployments or residual artifacts before they can be leveraged for lateral movement or privilege escalation.
Malware Family: Havoc Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 64[.]226[.]112[.]160:80 | botnet_cc | 2026-09-27 | 100% |
| ip:port | 64[.]226[.]112[.]160:443 | botnet_cc | 2026-09-27 | 100% |
| ip:port | 179[.]43[.]170[.]151:80 | botnet_cc | 2026-09-27 | 100% |
| ip:port | 64[.]226[.]112[.]160:22 | botnet_cc | 2026-09-27 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["64.226.112.160", "179.43.170.151"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.226.112.160", "179.43.170.151"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses the Havoc framework (or a similar C2 implementation) in a staging environment to test new microservice communication protocols, generating traffic that matches the known Havoc IOCs (e.g., specific TLS fingerprints or HTTP headers).
10.0.50.0/24 “Staging-Lab” subnet or tag hosts with the Azure AD group DevOps-Staging-Envs from the detection rule.Scenario: An IT administrator performs a scheduled vulnerability scan using a commercial tool (e.g., Qualys or Tenable) that leverages Havoc-based payloads for active probing, causing the scanner’s agent to emit the specific IOCs on the host.
qualys_agent.exe or tenable_agent.exe, or exclude hosts tagged with the CMDB attribute Role=Vulnerability-Scanner.Scenario: A security engineer conducts a red team exercise or penetration test using the Havoc framework to simulate an attacker, intentionally triggering the IOCs to validate detection coverage.
PenTest-Whitelist IP range (e.g., 192.168.200.10/32) during the test period.Scenario: A legacy application server running a custom-built .NET application inadvertently includes a library or component derived from open-source Havoc code, resulting in benign traffic that matches the IOC signatures (e.g., specific User-Agent strings or beacon intervals).