All Detections

Arkanix HVNC Startup Persistence

avatar
Ethan Andrews@eandrews
updated Feb 19, 20261017

Detects the creation of 'hvnc.py' in the Windows Startup folder, a persistence technique used by the Arkanix Stealer's HVNC module.

Microsoft Sentinel (KQL)