All Detections

PureHVNC AppData Persistence

avatar
Ibrahim Saud@tektrix
updated Jun 17, 2026001

Detects the creation of hidden executables deep within the AppData\Roaming directory, a characteristic behavior of PureHVNC for persistence.

Microsoft Sentinel (KQL)