Havoc Remote Injector Execution
Detects the execution of a malicious conhost.exe variant used by Havoc to inject its payload into cmd.exe, as described by Fortinet. This variant is typically found in the 'drivers' directory and launched with specific command-line arguments.
Sigma
