Havoc C2 - Hollowed Svchost Parent Anomaly (T1055.012)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Identifies Havoc C2 spawning an interactive shell (cmd.exe or powershell.exe) where the parent process is a hollowed svchost.exe lacking the -k parameter.