Havoc Demon In-Memory C2 Beaconing via PowerShell and wscript Stager

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

This rule detects common activity patterns associated with the Havoc C2 framework and general malicious PowerShell usage. It monitors for three primary indicators: VBScript stagers spawning PowerShell processes (e.g., in a Havoc-like delivery chain), PowerShell processes initiating DNS queries to DuckDNS infrastructure, and PowerShell processes performing cross-process memory injection indicative of shellcode execution (e.g., Demon in-memory agent).