WREAKING HAVOC: Hunting for Havoc C2 and Exorcising Demons from your Network | Threat SnapShot скачать в хорошем качестве

WREAKING HAVOC: Hunting for Havoc C2 and Exorcising Demons from your Network | Threat SnapShot

Attackers have a lot of choices when it comes to Command and Control (C2) frameworks - and we've covered many including Cobalt Strike, Brute Ratel, and Sliver. Havoc is a new arrival on the scene, and it's ability to evade standard defenses, like Windows Defender, makes it a go-to option for threat actors. Earlier in January, Zscaler ThreatLabz observed Havoc in a campaign targeting a Government organization, and in July Checkmarx observed it being used against the banking sector. We'll dig into Havoc and it's agent, Demon, and discuss detection and threat hunting strategies to prevent it from wreaking havoc in your network. References https://github.com/HavocFramework/Havoc https://www.bleepingcomputer.com/news... https://www.zscaler.com/blogs/securit... https://checkmarx.com/blog/first-know... SnapAttack Resources https://app.snapattack.com/collection... - Collection: Havoc C2 https://app.snapattack.com/threat/d0b... - Threat: Havoc C2 - HTTP Comms https://app.snapattack.com/detection/... - Detection: Suspicious POST Request Body https://app.snapattack.com/threat/cd1... - Threat: Havoc C2 - Default Configurations https://app.snapattack.com/detection/... - Detection: PowerShell Execution Via Named Pipe https://app.snapattack.com/threat/6c8... - Threat: Havoc C2 - Spawn CMD https://app.snapattack.com/detection/... - Detection: Potential CobaltStrike Process Patterns