ThreatFox: Havoc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Havoc post-exploitation framework by monitoring three specific Indicators of Compromise (IOCs) that signal potential command-and-control or lateral movement behaviors. SOC teams should proactively hunt for these signals in Azure Sentinel to rapidly detect and contain Havoc-based attacks before adversaries can establish persistence or exfiltrate sensitive data within the cloud environment.

IOC Summary

Malware Family: Havoc Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`62[.]171[.]166[.]237:8080`	botnet_cc	2026-08-15	75%
ip:port	`176[.]44[.]51[.]156:443`	botnet_cc	2026-08-15	75%
ip:port	`212[.]103[.]26[.]10:55000`	botnet_cc	2026-08-14	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["62.171.166.237", "212.103.26.10", "176.44.51.156"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["62.171.166.237", "212.103.26.10", "176.44.51.156"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Havoc

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Havoc IOCs detection rule:

Scenario: Antivirus Engine Updates via Scheduled Tasks
- Context: Enterprise endpoints running Microsoft Defender for Endpoint or Symantec Endpoint Protection often trigger scheduled update jobs (e.g., UpdateService.exe or ccSvcHst.exe) that download definition files from vendor servers. These downloads may match Havoc’s network IOCs if the vendor uses overlapping IP ranges or specific certificate hashes associated with the threat intelligence feed.
- Filter/Exclusion: Create an exclusion rule targeting the process names of known AV engines (e.g., MsMpEng.exe, ccSvcHst.exe) when they initiate outbound connections to trusted vendor update domains, regardless of the matched IOC hash or IP.
Scenario: Internal Patch Management Deployment
- Context: During weekly maintenance windows, Microsoft SCCM (Configuration Manager) or Jamf Pro deploys security patches and software updates across the fleet. The deployment agents (WUAEngine.exe, JamfProAgent) may establish connections to internal distribution points that share network signatures or file hashes similar to Havoc’s IOCs, particularly if the organization uses a proxy server with a common certificate chain.
- Filter/Exclusion: Exclude alerts where the source process is identified as a known patch management agent and the destination IP belongs to the organization’s internal DMZ or specific distribution point subnets (e.g., 10.x.x.x range).
Scenario: Cloud Backup and Synchronization Services
- Context: Legitimate data synchronization tools like Microsoft OneDrive for Business, Dropbox Business, or Veeam Agent frequently sync large datasets. These services often utilize cloud endpoints that may overlap with Havoc’s network IOCs,