ThreatFox: Havoc IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving known Indicators of Compromise (IOCs) linked to the Havoc toolset, which is frequently utilized in advanced post-exploitation and lateral movement phases. Proactively hunting for these IOCs within Azure Sentinel allows the SOC team to rapidly detect early-stage compromises and mitigate potential threats before they escalate into broader network incidents.

IOC Summary

Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["47.96.154.174", "151.236.21.109"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.96.154.174", "151.236.21.109"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Havoc

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Havoc IOCs detection rule within an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Windows Update

  • Context: The automated Windows Update service (usocd.exe) or a third-party AV agent (e.g., CrowdStrike, Symantec) periodically downloads definition updates from Microsoft’s content delivery network. These updates often contain embedded scripts or DLLs that match the file hashes or URLs associated with Havoc IOCs due to shared infrastructure or similar code signatures.
  • Filter/Exclusion: Exclude alerts where the process name is usocd.exe, MsMpEng.exe, or specific AV agents (e.g., C:\Program Files\CrowdStrike\fsquarant.exe) and the parent process is svchost.exe running under the SYSTEM account. Additionally, filter out network traffic originating from known Microsoft update IP ranges (e.g., 13.107.x.x).

• Scenario: Internal Software Deployment via SCCM/Intune

  • Context: During a scheduled maintenance window, the System Center Configuration Manager (SCCM) or Microsoft Intune pushes application patches to endpoints. The deployment agents (ccmexec.exe or DeviceCensus.exe) may execute scripts that reference external repositories containing artifacts with IOCs similar to Havoc’s known indicators (e.g., specific certificate thumbprints or script hashes).
  • Filter/Exclusion: Create an exclusion for processes initiated by the SCCM client service (ccmexec.exe) and Intune Management Agent (IntuneManagementAgent.exe). Filter based on the “User Context” being SYSTEM or a dedicated deployment account (e.g., DOMAIN\SCCM-Deploy-Svc) and restrict the scope to specific maintenance time windows (e.g., 0