HVNC-family C2 handshake detected (CLIENT_ID+VERSION markers)

Arnold Chan@slaz

•updated Sep 9, 2026•0•0•0

Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.