UltraVNC install artifacts (AccInfo.ini/History.txt) and port 10635 access

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•1

This rule detects potential VNC remote access activity by identifying systems that exhibit both the presence of specific VNC configuration/history files (AccInfo.ini, History.txt) and concurrent network activity on port 10635, which is commonly associated with VNC-like remote access tools.