This detection identifies adversary activity involving specific indicators of compromise (IOCs) linked to the Havoc post-exploitation tool, which is frequently utilized by threat actors for command and control operations within compromised networks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to rapidly detect early-stage lateral movement or persistence mechanisms before adversaries can fully establish a foothold and execute their broader attack campaigns.
Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 95[.]133[.]166[.]10:80 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 109[.]248[.]160[.]184:7070 | botnet_cc | 2026-08-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["109.248.160.184", "95.133.166.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["109.248.160.184", "95.133.166.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Havoc IOCs detection rule in an enterprise environment:
Scheduled Endpoint Protection Updates: The organization’s central management server (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) pushes a daily security definition update that includes a new hash or URL matching a known Havoc IOC. This often occurs during the nightly maintenance window when the update service downloads signatures from the vendor cloud.
Process Name is the specific endpoint agent updater (e.g., MsMpEng.exe, FalconSensorService) and the Source IP belongs to the internal management subnet, provided the event timestamp falls within the defined maintenance window (e.g., 02:00–04:00 local time).Internal Security Research & Threat Hunting: The internal SOC team or a third-party MSSP runs periodic threat hunting queries using tools like Splunk, Elastic SIEM, or Microsoft Sentinel to validate new IOCs. During these tests, analysts may manually trigger network traffic or execute scripts that intentionally match the Havoc signature to verify detection logic before full deployment.
10.20.50.x) and where the User Account is a dedicated service account named soc-hunt-service or similar, regardless of the matched IOC type.DevOps CI/CD Pipeline Execution: The enterprise utilizes Azure DevOps or GitHub Actions pipelines to deploy applications. These pipelines often pull dependencies from public repositories (e.g., npm, PyPI) that may contain artifacts with hashes or URLs overlapping with the Havoc IOCs, particularly when downloading build tools or scanning container images.