ThreatFox: Havoc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving four specific Indicators of Compromise (IOCs) linked to the Havoc post-exploitation framework, which is frequently utilized by threat actors for lateral movement and command execution within compromised networks. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly detect early-stage Havoc deployments that may evade standard signature-based defenses, thereby minimizing dwell time before attackers establish persistent footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: Havoc Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]140[.]213[.]2:443`	botnet_cc	2026-08-29	100%
ip:port	`45[.]140[.]213[.]2:8080`	botnet_cc	2026-08-29	100%
ip:port	`45[.]140[.]213[.]2:80`	botnet_cc	2026-08-29	100%
ip:port	`45[.]140[.]213[.]2:22`	botnet_cc	2026-08-29	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["45.140.213.2"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.140.213.2"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Havoc

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Havoc IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Endpoint Security Updates via Microsoft Defender
- Context: The Havoc IOC list may include file hashes or process names that overlap with standard updates pushed by Microsoft Defender for Endpoint (MDE) during its nightly maintenance window. When MDE downloads and installs new definition packs, it generates network traffic and file creation events matching the Havoc signatures.
- Filter/Exclusion: Exclude alerts where the Process Name is MsMpEng.exe or SenseiService.exe AND the Parent Process is TaskScheduler.exe. Additionally, filter out events occurring within the defined maintenance window (e.g., 02:00–04:00 local time) on known update servers.
Scenario: Automated Backup Jobs Using Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize specific agents that spawn processes with hashes identical to the Havoc IOCs during data staging and compression phases. These agents frequently access network shares and create temporary files, triggering the hunt package logic.
- Filter/Exclusion: Create an exclusion rule for Process Name containing VeeamAgent.exe, vrb.exe, or CommServe.exe. Ensure the exclusion applies only when the Source IP belongs to the designated backup subnet (e.g., 10.x.x.0/24) and the action is limited to file read/write operations rather than new process spawning from unknown directories.
Scenario: Deployment of Internal Tools via SCCM or Intune
- Context: During mass software deployments, System Center Configuration Manager (SCCM) or