Havoc Demon Process Injection: VirtualAllocEx+WriteProcessMemory+CreateRemoteThread

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.