Havoc C2 - Execute-Assembly .NET Injection (T1620)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•5

Detects the Havoc Demon utilizing execute-assembly to load post-exploitation .NET tooling (like Seatbelt or SharpHound) directly into memory without touching disk. This rule identifies processes loading 'mscoree.dll' (a .NET runtime component) and subsequently making network connections to non-localhost IP addresses, indicating potential in-memory .NET execution with C2 communication.