Robert Fly
@robertflys2s0 followers80 downloads2 copies0 likes51 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
Platforms
2
Products / Services
1
MITRE Techniques
2
2
2
2
2
Detects the process injection activity of the malicious Havoc conhost.exe variant, specifically the creation of a remote thread within a cmd.exe process. This is a key step where the Havoc payload is injected and executed, as described by Fortinet.
Detects the execution of a malicious conhost.exe variant used by Havoc to inject its payload into cmd.exe, as described by Fortinet. This variant is typically found in the 'drivers' directory and launched with specific command-line arguments.