Skip to content

Havoc

Software · ATTACK:enterprise:S1229

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1229",
  "title": "Havoc",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1229",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--1996aed9-6234-4c1d-a145-e8a4913679dd",
  "external_id": "S1229",
  "domain": "enterprise",
  "created": "2025-08-05T18:12:15.228Z",
  "modified": "2026-05-12T15:12:00.733Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [

  ]
}

Explicit source assertions (30)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19ff1c1a-cd11-454f-b905-16657eb866d6

Zscaler Havoc FEB 2023 · Fortinet Havoc MAR 2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20b9ce88-4d97-4395-b586-92732080808e

Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22f3b02d-e475-4d42-b4ae-b63da598e060

Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27ebfbf5-7d18-457d-899a-9a1213d01729

Zscaler Havoc FEB 2023 · Fortinet Havoc MAR 2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1204.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--319f9763-0663-4fb7-a106-17e3530d9e85

Fortinet Havoc MAR 2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--386c1b9d-1284-48d9-907f-daeb8cf20e9c

Immersive Labs Havoc C2 APR 2024 · Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a0a1c4d-2b99-4c72-9aa1-d002c403ee63

Immersive Labs Havoc C2 APR 2024 · Zscaler Havoc FEB 2023 · Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3db593a2-671e-45e6-b0a0-f48f2e8029dd

Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42e056c8-7037-4dc4-8b56-0b70bf396adc

Immersive Labs Havoc C2 APR 2024 · Zscaler Havoc FEB 2023 · Havoc Framework Documentation · Fortinet Havoc MAR 2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e52b5b5-5f7d-4900-aae0-34b2d71b90e0

Fortinet Havoc MAR 2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5046e931-5710-45b4-b5b4-39c58e61d733

Zscaler Havoc FEB 2023 · Havoc Framework Documentation · Fortinet Havoc MAR 2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5420c4d7-41ff-40d0-9225-05ba7dfe48f3

Immersive Labs Havoc C2 APR 2024

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54d857a4-d8d1-4234-b1e1-c8f4dd8f001e

Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55488927-0c46-4dfc-98f6-ceb530026578

Immersive Labs Havoc C2 APR 2024 · Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b8ccd02-050f-40fa-8d03-36f1cc8f952b

Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cd345e0-3571-4596-a817-dace4dd7080b

Check Point Wirte NOV 2024

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6dc62107-cba2-4cf7-b788-3df0ef232966

Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1016.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71e68523-de1b-4368-b6ae-4800466a92b1

Zscaler Havoc FEB 2023

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ceb3eaa-24bd-4418-851c-2af2fb3d56d8

Fortinet Havoc MAR 2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--964d3a29-afcb-4c4a-89a1-c1769d02221f

Havoc Framework Documentation

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:S1229

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9eb0b204-824c-490c-a8d1-39482ede076a

Check Point Wirte NOV 2024

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab60e20c-3b1f-4895-995a-e48e50bedb1d

Check Point Wirte NOV 2024

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbab58d1-29dd-4abd-8ba2-d13c357a7b31

Zscaler Havoc FEB 2023 · Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--beb80024-3f49-424e-b074-c0e1370f4402

Immersive Labs Havoc C2 APR 2024 · Zscaler Havoc FEB 2023 · Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c13cb2e5-09cb-4fcd-9fdb-58b147a25781

Immersive Labs Havoc C2 APR 2024 · Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce212708-cd21-4f5c-9d67-010cb216f561

Check Point Wirte NOV 2024

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2f1e84a-d6c2-460b-bc80-a90366f22b42

Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3afadc4-6eb6-40e7-afd8-a372e0dba6fa

Havoc Framework Documentation

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f61d2fc5-84df-4816-ae34-e6666a1082fe

Fortinet Havoc MAR 2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb038a8a-d851-4f8e-bda5-fe2d5ab20181

Havoc Framework Documentation

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.