ThreatFox: Havoc IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the Havoc framework, a post-exploitation tool frequently used by adversaries for command and control and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or network artifacts before the attacker can establish persistent access or escalate privileges.

IOC Summary

Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["57.154.15.252", "158.247.202.60"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["57.154.15.252", "158.247.202.60"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Havoc

False Positive Guidance

• Scenario: A DevOps engineer uses the Havoc framework (or a similar C2 tool like Sliver or Covenant) in a staging environment to test new microservice communication protocols, where the specific IP addresses or domain names from the ThreatFox IOCs are hardcoded in the test configuration files or DNS records.
  • Filter/Exclusion: Exclude events where the source process is python.exe or java.exe running from a known development path (e.g., C:\dev\havoc-test\) or where the destination IP is within the designated staging subnet (e.g., 10.20.0.0/24).
• Scenario: An IT administrator performs a routine network audit using a tool like Nmap or Advanced IP Scanner that scans the specific IP ranges or domains listed in the Havoc IOCs to verify asset inventory, triggering the detection due to the matching network indicators.
  • Filter/Exclusion: Exclude alerts where the initiating process is nmap.exe, advipscan.exe, or ping.exe and the user account belongs to the IT-Admins or Network-Team security group.
• Scenario: A scheduled PowerShell script used for automated backup verification or health checks pings or resolves the specific domain names associated with the Havoc IOCs as part of a connectivity test to external services, causing a false positive.
  • Filter/Exclusion: Exclude events where the command line contains Resolve-DnsName or Test-Connection and the parent process is powershell.exe or pwsh.exe initiated by a scheduled task named Daily-Health-Check or similar.
• Scenario: A security team runs a controlled test using a tool like Wireshark or Fiddler to capture traffic against