UltraVNC Viewer Process Creation
This rule detects the creation of processes associated with UltraVNC Viewer, a legitimate remote access software. Adversaries often use such tools to establish command and control (C2) channels to target systems, enabling remote interaction and control. The rule specifically looks for process creation events where the description is 'VNCViewer', the product is 'UltraVNC VNCViewer', the company is 'UltraVNC', or the original filename is 'VNCViewer.exe'.
Sigma
