Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
The Havoc framework is publicly available and has been associated with known attack campaigns. Command-and-control (C&C) beaconing traffic generated by a Havoc demon agent indicates that an attacker can remotely control a device and gain an entry point for further attacks on the network.
Kill Chain
Risk Score
88
Havoc is a post-compromise C&C framework. A Havoc demon agent is installed on the victim device after a user downloads a malicious executable payload. The demon agent initiates beaconing activity by sending an HTTP POST request to the Havoc teamserver. Beaconing refers to short messages periodically sent from a compromised device to a C&C server requesting additional instructions from an attacker.
Quarantine the device while checking for malware
