This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Havoc post-exploitation framework, which is frequently used by threat actors for lateral movement and command execution within compromised networks. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly detect early-stage intrusions leveraging Havoc’s capabilities, thereby minimizing dwell time before adversaries establish persistent footholds or exfiltrate sensitive data.
Malware Family: Havoc Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 31[.]76[.]102[.]46:443 | botnet_cc | 2026-08-31 | 100% |
| ip:port | 31[.]76[.]102[.]46:8081 | botnet_cc | 2026-08-31 | 100% |
| ip:port | 31[.]76[.]102[.]46:22 | botnet_cc | 2026-08-31 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["31.76.102.46"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.76.102.46"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are the false positive scenarios and corresponding filters for the ThreatFox: Havoc IOCs detection rule:
Scenario: The Security Operations Center (SOC) team performs routine threat intelligence updates by importing a new feed containing Havoc indicators into the Microsoft Defender for Endpoint console.
msdefender.exe or mpcmdrun.exe and the user context is the dedicated service account (e.g., DOMAIN\SIEM-Admin) performing a “Threat Intelligence Import” action via the Defender API.Scenario: A scheduled nightly backup job utilizing Veeam Backup & Replication scans the network shares where Havoc-related configuration files or sample artifacts are stored, triggering file hash matches against the rule’s IOCs.
vbrservice.exe (Veeam) occurring during the defined maintenance window (e.g., 02:00–04:00 UTC) on specific backup server hosts.Scenario: The DevOps team executes a containerized security scan using Trivy within the CI/CD pipeline, which pulls down known Havoc sample binaries for vulnerability analysis in the development environment.
trivy or dockerd, and the event type is classified as a “Scheduled Pipeline Run.”Scenario: The IT Helpdesk utilizes Sysinternals Process Explorer to manually investigate a user-reported issue, opening a known Havoc test executable that resides in a shared network drive used for software testing.