HVNC Hidden-Desktop Backdoor Process Execution (UpdateAssistant/AppUpdateHelper)
Detects the execution of known HVNC (Hidden Virtual Network Computing) backdoor binaries identified by specific file names and staging directory paths. These binaries are designed to create hidden desktop sessions and perform input injection to facilitate unauthorized remote control of a compromised host.
Microsoft Sentinel (KQL)
