Havex Trojan PHP Server

Hunt Hypothesis

This detection identifies the presence of the Havex Trojan on PHP web servers by scanning for specific file artifacts known to establish persistence and command-and-control channels. Proactive hunting is essential in Azure Sentinel to uncover dormant infections that may evade standard signature-based alerts, allowing analysts to assess lateral movement risks before an active outbreak occurs.

YARA Rule

rule Havex_Trojan_PHP_Server
{
    meta:
        Author      = "Florian Roth"
        Date        = "2014/06/24"
        Description = "Detects the PHP server component of the Havex RAT"
        Reference   = "www.f-secure.com/weblog/archives/00002718.html"

    strings:
        $s1 = "havex--></body></head>"
        $s2 = "ANSWERTAG_START"
        $s3 = "PATH_BLOCKFILE"

    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Havex Trojan PHP Server detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated CMS Plugin Updates via Jenkins CI/CD Pipeline

  • Scenario: A scheduled Jenkins job (running on a Linux build server) automatically pulls the latest version of a WordPress plugin from a remote repository and unpacks it into the /var/www/html/wp-content/plugins directory. The YARA rule flags the unzip or tar extraction process because the temporary PHP files being written contain standard library functions common to Havex (e.g., specific curl initialization patterns).
  • Filter/Exclusion: Exclude file creation events where the parent process is jenkins-agent, maven, or docker and the destination path matches known application directories (e.g., /var/www/html/*). Additionally, filter out alerts where the file hash matches a known “clean” baseline from the last 30 days.

• Legacy PHP-Based Reporting Dashboard Deployment

  • Scenario: The IT Operations team deploys a custom internal reporting dashboard using an older version of Laravel (v5.x) via a scheduled PowerShell script (Deploy-Report.ps1) running on a Windows Server. This deployment involves copying thousands of .php files that utilize standard HTTP client libraries which share signature overlaps with the Havex command-and-control communication logic.
  • Filter/Exclusion: Create an exclusion for the specific user account svc-deploy-bot and the process name PowerShell.exe. Furthermore, tune the rule to ignore alerts where the file modification time aligns with the known maintenance window (e.g., Sundays between 02:00–04:00 UTC).

• Third-Party Web Application Firewall (WAF) Log Analysis

  • Scenario: The enterprise