Havoc C2 Agent Beacon Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects beaconing activity associated with the Havoc C2 agent. It specifically looks for HTTP POST requests to the '/login' URI, with a User-Agent header of 'Mozilla/5.0', and a data size between 101 and 499 bytes. A threshold of 10 such events within 60 seconds from the same source IP triggers the alert, indicating potential command and control communication.