Suspicious UltraVNC Auto-Reconnect Execution
Detects suspicious UltraVNC command line flag combinations that indicate an auto-reconnect upon execution, often used for persistence or remote access. This behavior has been observed in campaigns by the Gamaredon threat group.
Sigma
