ThreatFox: Havoc IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt identifies potential Havoc framework activity by correlating network traffic or host artifacts with known indicators of compromise, such as specific beaconing patterns or file hashes. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate compromised assets before the adversary can establish persistent command-and-control channels or execute further post-exploitation actions.

IOC Summary

Malware Family: Havoc Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`154[.]36[.]161[.]180:443`	botnet_cc	2026-09-16	75%
ip:port	`207[.]89[.]17[.]5:5901`	botnet_cc	2026-09-16	100%
ip:port	`207[.]89[.]17[.]5:22`	botnet_cc	2026-09-16	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["154.36.161.180", "207.89.17.5"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.36.161.180", "207.89.17.5"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Havoc

False Positive Guidance

Scenario: A DevOps team deploys a custom internal monitoring agent or a lightweight EDR sensor that uses a known Havoc beacon hash or specific C2 domain for its heartbeat mechanism.
- Filter/Exclusion: Exclude processes where the parent is a known deployment tool (e.g., ansible-playbook, terraform apply, or k8s.io/kubectl) or exclude specific service accounts used for infrastructure management (e.g., svc-deployer, svc-monitoring).
Scenario: An IT administrator runs a legacy backup script or data migration tool that temporarily binds to a port or resolves a DNS record matching one of the Havoc IOCs (e.g., a specific IP range or domain) for internal staging purposes.
- Filter/Exclusion: Exclude events where the source process is part of the backup suite (e.g., VeeamBackup.exe, CommvaultAgent.exe, or rsync) and the destination IP is within the internal RFC1918 range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Scenario: A security team performs a periodic vulnerability scan or network discovery using a tool like Nmap or Masscan that probes known Havoc C2 addresses to verify firewall rules or detect shadow IT.
- Filter/Exclusion: Exclude connections initiated by known scanning tools (e.g., nmap.exe, masscan.exe, zmap) or exclude events where the source user belongs to the SecurityTeam or NetOps group.
Scenario: A web application server (e.g., IIS or Apache) receives a legitimate HTTP request from a client whose User-Agent string or Referer header contains a substring matching one of