ThreatFox: Havoc IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the Havoc framework, which adversaries frequently deploy to establish persistent command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the attacker can leverage the framework for lateral movement or privilege escalation.

IOC Summary

Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["85.9.199.115"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["85.9.199.115"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Havoc

False Positive Guidance

• Legacy Build Agent Cleanup: A CI/CD pipeline (e.g., Jenkins or GitLab Runner) executes a post-build cleanup script that uses curl or wget to fetch a specific build artifact or dependency from a public mirror. If the mirror’s IP or domain is listed in the Havoc IOC set, this legitimate fetch triggers the alert.
  • Filter/Exclusion: Exclude network connections where the source process is java.exe (Jenkins) or runner-agent and the destination port is 80/443, specifically for known internal build artifact repositories.
• Ad-Hoc Vulnerability Scanning: A security engineer manually runs a lightweight scanning tool (e.g., nmap or masscan) against a subset of internal hosts to verify patch compliance. The tool may use a temporary listener or connect to a known public reference IP (e.g., for time synchronization or certificate pinning) that coincides with a Havoc IOC.
  • Filter/Exclusion: Exclude alerts where the source user belongs to the SecurityOps or BlueTeam group and the process name is nmap.exe or masscan.exe, provided the connection is unidirectional (no inbound connection to the scanner).
• Scheduled Log Rotation & Archiving: A scheduled task (e.g., logrotate on Linux or a PowerShell script on Windows) compresses and transfers daily logs to an external S3-compatible storage bucket. If the storage endpoint’s IP address is part of the Havoc IOC list, the outbound HTTPS connection triggers the rule.
  • Filter/Exclusion: Exclude network events where the destination port is 443, the source process is powershell.exe or rsync, and the destination domain matches the known internal log archive bucket (e.g., logs-archive.internal-corp.com).