Havoc C2 Registry Fallback Persistence
Detects the creation or modification of specific registry values (UXMP, UFID, UCID) in known Havoc C2 fallback registry paths (e.g., \SOFTWARE\Classes\Local Settings\Software\Microsoft\ and \SOFTWARE\Microsoft\SQMClient\) used by a modified Havoc Demon agent for C2 fallback and configuration.
Microsoft Sentinel (KQL)
