explorer.exe running on a non-default desktop (HVNC indicator)
Detects the execution of explorer.exe on an alternate, non-default Windows desktop. This behavior is a common indicator of Hidden VNC (hVNC) attacks where malware creates an isolated, invisible desktop environment to interact with the victim's session remotely and surreptitiously.
Microsoft Sentinel (KQL)
