ThreatFox: Havoc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Havoc post-exploitation framework by monitoring for five specific indicators of compromise known to facilitate command-and-control and lateral movement. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly detect early-stage intrusions that leverage Havoc’s capabilities, thereby minimizing dwell time before attackers establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Havoc Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`70[.]34[.]215[.]48:22`	botnet_cc	2026-07-26	100%
ip:port	`70[.]34[.]215[.]48:443`	botnet_cc	2026-07-26	100%
ip:port	`101[.]33[.]76[.]127:80`	botnet_cc	2026-07-26	100%
ip:port	`101[.]33[.]76[.]127:22`	botnet_cc	2026-07-26	100%
ip:port	`200[.]234[.]219[.]26:21`	botnet_cc	2026-07-26	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["70.34.215.48", "200.234.219.26", "101.33.76.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["70.34.215.48", "200.234.219.26", "101.33.76.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Havoc

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Havoc IOCs detection rule, including tailored filters and exclusions for an enterprise environment:

Scenario: Scheduled Antivirus Definition Updates
- Context: The enterprise uses Microsoft Defender for Endpoint or Symantec Endpoint Protection. During nightly maintenance windows (e.g., 02:00 AM), the update service connects to vendor repositories that share IP ranges or hash signatures with the Havoc IOCs. This often triggers alerts when the AV engine downloads large definition packs containing similar file hashes.
- Filter/Exclusion: Create a time-based exclusion for the rule between 01:30 and 04:30 daily on all endpoints running the specific AV agent version. Alternatively, add the specific IP ranges of the vendor update servers (e.g., *.update.microsoft.com) to the allow-list within the ThreatFox platform.
Scenario: Automated Backup Agent Connectivity
- Context: The organization utilizes Veeam Backup & Replication or Rubrik. The backup agents on file servers periodically initiate connections to the central management server and cloud storage buckets (e.g., AWS S3, Azure Blob) using ports and protocols that match Havoc’s network IOCs. These legitimate high-volume data transfers can mimic the command-and-control traffic patterns of the Havoc malware.
- Filter/Exclusion: Exclude processes named VeeamTransportService.exe or rubrik-agent from the detection logic. Additionally, configure a filter to suppress alerts where the destination IP belongs to known cloud storage CIDR blocks (e.g., 10.254.x.x for internal Veeam repositories).
Scenario: Patch Management Deployment via SCCM
- Context: The IT team uses **Microsoft Configuration Manager (SCCM