ThreatFox: Havoc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Havoc post-exploitation tool, which attackers utilize to establish persistence and execute lateral movement within compromised networks. A proactive hunt for these IOCs in Azure Sentinel is critical because early identification of Havoc artifacts enables the SOC team to rapidly contain active threats before they can deploy additional payloads or exfiltrate sensitive data.

IOC Summary

Malware Family: Havoc Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`93[.]152[.]223[.]39:9090`	botnet_cc	2026-08-12	100%
ip:port	`93[.]152[.]223[.]39:8080`	botnet_cc	2026-08-12	100%
ip:port	`93[.]152[.]223[.]39:22`	botnet_cc	2026-08-12	100%
ip:port	`93[.]152[.]223[.]39:5900`	botnet_cc	2026-08-12	100%
ip:port	`93[.]152[.]223[.]39:80`	botnet_cc	2026-08-12	100%
ip:port	`93[.]152[.]223[.]39:443`	botnet_cc	2026-08-12	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["93.152.223.39"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["93.152.223.39"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Havoc

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Havoc IOCs detection rule, tailored for a legitimate enterprise environment:

Scenario: Automated Vulnerability Scanning by Qualys or Tenable
- Context: Enterprise security teams routinely run vulnerability assessments where scanners (e.g., Qualys Cloud Agent, Tenable Nessus) actively probe internal hosts. These scanners often initiate connections to known external update servers or threat intelligence feeds that share IP ranges with the Havoc IOCs.
- Filter/Exclusion: Exclude traffic originating from specific scanner service accounts (e.g., svc-qualys-scan) or restrict the rule trigger to exclude the specific CIDR blocks of the vulnerability management platform’s update servers if they match the Havoc IOC list.
Scenario: Scheduled Microsoft Defender for Endpoint (MDE) Cloud Updates
- Context: The MDE agent performs scheduled cloud-based policy updates and definition downloads every morning at 04:00 AM. During this window, agents connect to Microsoft’s global update infrastructure, which may include IP addresses or domains currently flagged as Havoc IOCs due to shared hosting providers.
- Filter/Exclusion: Create a time-based exclusion for the rule between 03:00 and 06:00 on weekdays, or add an exception for traffic where the ProcessName is MsMpEng.exe (Microsoft Defender Antivirus) and the destination port matches standard update ports (e.g., 443).
Scenario: Third-Party SaaS Integration (e.g., Jira or ServiceNow)
- Context: Business units utilize external collaboration tools like Atlassian Jira or ServiceNow for ITSM. These platforms often host their backend services on cloud providers that overlap with the Havoc IOC list. Legitimate API calls from internal workstations to these