Explorer.exe spawned on non-default desktop (Dolphin X HVNC indicator) - tightened
Detects the creation of explorer.exe processes on non-default Windows desktops, which is a known indicator of Hidden VNC (HVNC) activity often utilized by the Dolphin X stealer. The rule mitigates false positives by excluding legitimate non-default desktop uses (like RDP/Citrix/VDI brokers) and requires correlation with a recent network connection from the newly spawned explorer.exe process.
Microsoft Sentinel (KQL)
