Operation Poisson: Havoc C2 & RustDesk Fileless Campaign — OTX Pulse Analysis

---
title: Potential Havoc C2 Agent Activity via DuckDNS
id: 5c7d3a1b-8f9e-4b2a-9c1d-5e6f7a8b9c0d
description: Detects potential network connection to a DuckDNS domain associated with Operation Poisson Havoc C2 infrastructure.
status: experimental
date: 2026/07/19
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/636... (Operation Poisson)
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|endswith: '.duckdns.org'
    filter_main_legit:
        DestinationHostname|contains:
            - 'wawsenti' # Specific hostname from pulse
    condition: selection and filter_main_legit
falsepositives:
    - Legitimate use of DuckDNS (rare in enterprise)
level: high
---
title: Python Script Execution with Keystroke Capture Libraries
id: d4e5f6a7-8b9c-0d1e-2f3a-4b5c6d7e8f9a
description: Detects execution of Python scripts attempting to import keylogging libraries, indicative of the Poisson actor's 70-line keylogger.
status: experimental
date: 2026/07/19
author: Security Arsenal
tags:
    - attack.credential_access
    - attack.t1056.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\python.exe'
    selection_cli:
        CommandLine|contains:
            - 'pynput'
            - 'keyboard'
            - 'pyxhook'
    condition: all of selection_*
falsepositives:
    - Legitimate developer testing of input libraries
level: medium
---
title: Unauthorized RustDesk Remote Access Execution
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects the execution of RustDesk, a remote desktop tool abused by the Poisson actor for C2.
status: experimental
date: 2026/07/19
author: Security Arsenal
tags:
    - attack.command_and_control
    - attack.t1219
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains: '\rustdesk'
        Image|endswith: '.exe'
    condition: selection
falsepositives:
    - Authorized use by IT support team
level: high


kql
// Hunt for Operation Poisson IOCs and Behaviors
// 1. Network Connections to known C2 domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "duckdns.org" 
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP

// 2. Process creations matching file hashes
DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "0378a5ef51b008aa2d6b76bd44a0bf061339bc3b737a188ec82029444d4d18fe",
    "1f00fd604bb18bbe3081f9ce8d741c4029d2a2125eb8888ac4e0d955938059d6",
    "291cb1fd0f2709b4457447cbb87adacf5c36c1bcb0f8754524024d44174bb195",
    "3b7642b0f84e83a36334c608655c6cb7aae774839a6a3488526b853d89830a60",
    "aa7ea19e34567458b4ee66a7cd274181764984bf32123f756a7fdc64d5857b31",
    "c79091ceae7cd592fc08e4854cda7c1182af762b6b126371cc604debdc995fc7",
    "f06e7e1a4363a01ba2a4fee2e28abdd623abf4194bda373f23ff0e151b5c2b45"
)
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessCommandLine

// 3. PowerShell or Python spawning child processes typical of fileless attacks
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (ProcessVersionInfoOriginalFileName in ("python.exe", "pythonw.exe") or FileName endswith ".py")
| where ProcessCommandLine has "import"
| summarize count() by DeviceName, ProcessCommandLine, bin(Timestamp, 5m)


powershell
# Operation Poisson IOC Hunter
# Checks for file hashes and Hosts file modifications

$IOC_Hashes = @(
    "0378a5ef51b008aa2d6b76bd44a0bf061339bc3b737a188ec82029444d4d18fe",
    "1f00fd604bb18bbe3081f9ce8d741c4029d2a2125eb8888ac4e0d955938059d6",
    "291cb1fd0f2709b4457447cbb87adacf5c36c1bcb0f8754524024d44174bb195",
    "3b7642b0f84e83a36334c608655c6cb7aae774839a6a3488526b853d89830a60",
    "aa7ea19e34567458b4ee66a7cd274181764984bf32123f756a7fdc64d5857b31",
    "c79091ceae7cd592fc08e4854cda7c1182af762b6b126371cc604debdc995fc7",
    "f06e7e1a4363a01ba2a4fee2e28abdd623abf4194bda373f23ff0e151b5c2b45"
)

Write-Host "[+] Hunting for Operation Poisson File Hashes..."

# Check common user directories and temp
$paths = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\AppData\Local\Temp", "C:\Windows\Temp")

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hash -in $IOC_Hashes) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) | Hash: $hash" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking Hosts file for wawsenti.duckdns.org..."
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $hostsPath) {
    $content = Get-Content $hostsPath
    if ($content -match "wawsenti.duckdns.org") {
        Write-Host "[!] SUSPICIOUS ENTRY FOUND IN HOSTS FILE!" -ForegroundColor Red
        Select-String -Path $hostsPath -Pattern "wawsenti.duckdns.org"
    } else {
        Write-Host "[-] No suspicious hosts entries found."
    }
}

Write-Host "[+] Hunt Complete."