Havoc C2 - Payload Staging in Public/AppData (T1074.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•2

Correlates the initial Fake Tech Support lure with the dropping of the secondary Havoc .exe or .dll payload into C:\Users\Public or %AppData%. This rule detects the creation of executable or DLL files in common public or user application data directories, specifically within 'C:\Users\Public' or 'C:\Users\<username>\AppData\Local', and correlates this file creation with a process that has '--kiosk' in its command line, which is often associated with browser-based lures.