Havoc Demon In-Memory C2 via PowerShell Loader and Process Injection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects execution patterns associated with the Havoc C2 framework's Demon implant. This includes PowerShell loaders with encoded/non-interactive flags spawned by suspicious script interpreters, PowerShell execution spawned from explorer.exe, and suspicious remote thread injection into explorer.exe from unauthorized processes.