HVNC Backdoor Process (Keylogger Module) Execution Indicators
Detects the execution of suspected Hidden VNC (HVNC) backdoor components that demonstrate behaviors consistent with banking credential theft, specifically targeting keystroke logging APIs. The rule monitors for specific process names executing from suspicious directories often used for persistence.
Microsoft Sentinel (KQL)
