ThreatFox: Havoc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Havoc exploit kit by monitoring four specific Indicators of Compromise (IOCs) known to facilitate initial access and command execution within Azure Sentinel environments. Proactive hunting for these IOCs is critical because early identification of Havoc-related artifacts enables the SOC team to rapidly isolate compromised assets before lateral movement or data exfiltration occurs, thereby minimizing potential impact from high-severity threats.

IOC Summary

Malware Family: Havoc Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`68[.]221[.]168[.]156:443`	botnet_cc	2026-08-26	100%
ip:port	`68[.]221[.]168[.]156:80`	botnet_cc	2026-08-26	100%
ip:port	`49[.]232[.]135[.]25:22`	botnet_cc	2026-08-26	100%
ip:port	`31[.]207[.]38[.]75:22`	botnet_cc	2026-08-26	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["31.207.38.75", "68.221.168.156", "49.232.135.25"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.207.38.75", "68.221.168.156", "49.232.135.25"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Havoc

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Havoc IOCs detection rule in an enterprise environment:

Scenario: Automated Vulnerability Scanning by Internal Security Tools
- Context: Enterprise vulnerability management platforms like Tenable Nessus, Qualys, or Rapid7 InsightVM frequently perform active network scans. These tools often utilize the same IOCs (hashes, URLs, or IP addresses) associated with the Havoc framework to test endpoint detection capabilities or simulate threat intelligence feeds, triggering alerts when they “detect” their own simulated artifacts.
- Filter/Exclusion: Create a rule exclusion based on the Source Host being part of the Vulnerability-Scanner AD Security Group or IP range (e.g., 10.20.50.x). Additionally, filter out events where the Process Name matches known scanner executables such as nessus.exe, qualyspc.exe, or insight-agent.exe.
Scenario: Scheduled Threat Intelligence Feed Ingestion by EDR/SIEM
- Context: Security Information and Event Management (SIEM) platforms like Splunk, Microsoft Sentinel, or IBM QRadar often ingest daily threat intelligence feeds. If the Havoc IOCs are part of a shared industry feed (e.g., via MISP or TAXII), the ingestion process itself may generate logs that match the detection logic, especially if the EDR agent (like CrowdStrike Falcon or Carbon Black) is configured to validate these incoming feeds locally.
- Filter/Exclusion: Exclude events where the Parent Process is a scheduled task runner such as TaskScheduler.exe or specific service accounts like svc-siem-feed. Implement a time-based exclusion for known ingestion windows (e.g., exclude alerts generated between 02