ThreatFox: Havoc IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the Havoc framework, a post-exploitation tool frequently used by adversaries for command and control and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential footholds or active sessions before they escalate into more complex intrusions or data exfiltration events.

IOC Summary

Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["109.205.212.241", "209.38.100.69"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["109.205.212.241", "209.38.100.69"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Havoc

False Positive Guidance

• Scenario: A DevOps engineer runs a containerized CI/CD pipeline using a custom Docker image that includes the havoc client binary for internal red teaming or chaos engineering tests, which is not excluded from the endpoint scan.
  • Filter/Exclusion: Exclude processes where the parent process is dockerd or containerd-shim, or specifically exclude file paths containing /opt/ci-pipeline/ or /usr/local/bin/havoc-client if it is a known internal tool.
• Scenario: An IT administrator installs a third-party endpoint detection and response (EDR) agent or a specific security tool (e.g., CrowdStrike Falcon, Carbon Black) that bundles a generic havoc module or uses a similar naming convention for its internal communication daemon.
  • Filter/Exclusion: Exclude processes whose executable path resides in standard EDR installation directories such as C:\Program Files\CrowdStrike\ or C:\Program Files\Carbon Black\, or filter by known EDR service names like FalconSensor or cb.exe.
• Scenario: A scheduled maintenance job (e.g., via Task Scheduler or cron) executes a backup or log rotation script that temporarily creates a temporary file named havoc.tmp or havoc.log in a system temp directory (%TEMP% or /tmp) before moving it to the archive.
  • Filter/Exclusion: Exclude file events where the file extension is .tmp or .log and the path is under standard temporary directories (C:\Users\%USERNAME%\AppData\Local\Temp\ or /tmp/), or filter by the parent process being a known scheduler like schtasks.exe or cron.
• Scenario: A developer uses a local IDE (e.g., VS Code, IntelliJ) with a plugin that