How do you detect Havoc C2?

Detect Havoc's Demon implant with a mix of network and behavioural signals. On the wire, hunt default HTTP header/URI patterns and the team-server JARM, and apply beacon-timing analysis to the periodic check-ins. On the host, Demon's sleep obfuscation defeats single-shot memory scans, so rely on EDR telemetry for execution from unbacked RX memory, indirect-syscall patterns and anomalous thread start addresses / spoofed return addresses. Correlate signals; defaults drift between Havoc versions.

Detecting Havoc C2: Demon Implants and Default Profiles

Havoc is a modern open-source C2 whose Demon agent leans hard on evasion: sleep obfuscation (Ekko/Foliage), indirect syscalls and return-address spoofing. That raises the bar for memory detection, so defenders lean on network defaults and behavioural host signals until operators customise the profile.

Signals at a Glance

Signal	Where	ATT&CK
Default Havoc HTTP headers / URI patterns	Proxy, Zeek	T1071.001
Known Havoc team-server JARM	Network, scan data	T1573.002
Indirect syscalls / unbacked RX memory executing	EDR, ETW	T1106
Sleep-obfuscation memory encrypt/decrypt cycling	EDR memory telemetry	T1027.009
Beacon-like periodic check-in with jitter	Flow/proxy	T1571

Default Profile Artifacts

Out-of-the-box Havoc listeners carry recognisable request headers and URI structure. The best-known indicator is an anomalous or malformed header ordering combined with a default user-agent. Hunt proxy logs for the combination rather than any single value:

// KQL hunt: default Havoc-like header + periodic polling
// (indicators drift across versions; treat as a hunt, not a fixed block)
ProxyLogs
| where UserAgent has "Mozilla/5.0" and RequestHeaders has_any ("X-Havoc","Hdr-")
      or (ContentLength == 0 and Method == "GET")
| summarize hits=count(), by SrcIp, Host, UserAgent, bin(TimeGenerated, 30m)
| where hits > 20

Beating the Evasion

Because sleep obfuscation encrypts Demon's memory between beacons, single-shot scans miss it. Focus on the moments it must be unencrypted and executing, and on behaviour the evasion cannot hide:

Use EDR telemetry for execution from unbacked (non-image) RX memory and for indirect-syscall patterns — the evasion hides the sleep, not the work.
Hunt thread start addresses that do not map to a loaded module, and stacks that unwind through anomalous return addresses (return-address spoofing leaves artifacts).
Catch the network heartbeat: Demon still phones home on a schedule, so beacon-timing analysis remains effective regardless of memory evasion.

Vetted sources

Havoc's defaults change between releases, so community JARM values and header indicators drift — treat them as hunting leads. The durable detections are behavioural: unbacked-memory execution, anomalous thread start addresses and beacon timing. Validate against your EDR's telemetry schema.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Default Profile Artifacts

Beating the Evasion

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

Mythic C2 Detection