Havoc C2 - Demon Sleep Obfuscation Behavior (T1027)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects Havoc C2's Sleep Obfuscation (Ekko/FOLIAGE) technique where a process creates remote threads into itself with suspicious start addresses to hide its memory while sleeping. This rule specifically looks for CreateRemoteThread API calls where the target process is the same as the initiating process, excluding common legitimate processes like chrome.exe, msedge.exe, and svchost.exe.