This hypothesis targets the presence of known Indicator of Compromise (IOC) artifacts associated with the Havoc framework, which adversaries frequently deploy to establish persistent command-and-control channels and execute post-exploitation tasks. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or infrastructure before the attacker can fully leverage the Havoc agent for lateral movement or data exfiltration.
Malware Family: Havoc Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 78[.]17[.]93[.]159:8090 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 54[.]247[.]42[.]8:80 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 51[.]159[.]21[.]191:8446 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 104[.]238[.]61[.]67:4444 | botnet_cc | 2026-09-28 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["51.159.21.191", "78.17.93.159", "54.247.42.8", "104.238.61.67"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["51.159.21.191", "78.17.93.159", "54.247.42.8", "104.238.61.67"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Havoc client binary (often named havoc.exe or similar) to a staging environment for integration testing of a new C2 framework, triggering the hash or filename IOC.
powershell.exe or pwsh.exe and the working directory contains C:\DevOps\Staging\ or C:\QA\Environments\.Havoc client from the official GitHub repository to a jump box for a one-off network audit, where the binary is executed directly from the Downloads folder, matching the path or hash IOC.
C:\Users\<username>\Downloads\ and the user account belongs to the IT-Admins or Security-Team security group.Havoc client binary (used for internal red teaming exercises) from a shared network drive to a local temp directory, triggering the file creation or execution IOC.
\\fileserver\redteam\ and the destination path contains \Temp\ or \AppData\Local\Temp\.Havoc client binary, which may be misinterpreted as an execution or active threat by the detection logic.