Havoc C2 - Demon HTTP Beaconing (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•2

Identifies Havoc Demon payloads beaconing to anomalous, predictable HTTP/HTTPS URIs used by default Havoc profiles (e.g., /weather, /api/v1). The detection specifically looks for HTTP connections originating from processes located in the 'Downloads' folder.