This hunt targets known indicators of compromise associated with the Havoc framework, a post-exploitation tool frequently used by adversaries for command and control and payload execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential footholds or lateral movement activities before they escalate into a full breach.
Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 16[.]5[.]7[.]159:443 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 104[.]248[.]156[.]16:443 | botnet_cc | 2026-09-11 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["104.248.156.16", "16.5.7.159"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.248.156.16", "16.5.7.159"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
curl or wget to download a specific Havoc payload (e.g., a .exe or .dll) from a public GitHub repository or internal artifact registry for testing or deployment purposes.
curl.exe, wget.exe, or powershell.exe and the destination path resides in known development directories (e.g., C:\Users\<user>\Downloads, C:\dev\, C:\temp\) or where the user account is tagged with the devops-team AD group.\\<server>\share\ or USB\ and the user account is part of the local-admins or it-support security group, provided the event occurs during defined maintenance hours (e.g., 02:00–05:00 UTC).red-team or security-ops AD group, or where the source machine hostname matches the pattern RT-* or SEC-* (e.g., RT-AGENT-01).