HVNC Backdoor AV-Status Beacon to Known C2 (UpdateAssistant/SysMaintenance)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects suspicious processes (named UpdateAssistant.exe, AppUpdateHelper.exe, or SysMaintenance.exe) executing from specific file system paths and initiating network connections to known suspicious IP addresses (5.230.249.49, 40.124.169.27) on non-standard ports (27015, 27017). The rule correlates process execution from specific suspicious directories with network activity to identify potential command-and-control communication.