HVNC Backdoor Sustained Beaconing to Hardcoded C2 IP on Non-Standard Port

Arnold Chan@slaz

•updated Sep 9, 2026•0•0•1

Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.