T1021.005 — VNC

Tactic: Lateral Movement · Platforms: Linux, Windows, macOS

Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen,…

Sub-technique of Remote Services (T1021).

Sigma detection rules (3)

T1021.005 Remote Services: VNC

title: "T1021.005 Remote Services: VNC"
id: f6b8b963-d546-48a5-8607-ec7eb968456c
description: 'Behavioral Detection of Unauthorized VNC Remote Control Sessions. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, VNCBinaryList, LogonType.'
references:
  - https://attack.mitre.org/techniques/T1021/005
author: Shahrukh Khan
date: 2026-02-18
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.005

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\vncviewer.exe'
      - '\tvnserver.exe'
      - '\winvnc.exe'
      - '\UltraVNC.exe'

  condition: selection

falsepositives:
  - Legitimate remote-support usage of an approved VNC client/server in environments where VNC is sanctioned IT tooling.

level: medium

T1021.005 Remote Services: VNC

title: "T1021.005 Remote Services: VNC"
id: fc34e834-aaa1-4cf8-b733-7d4159b1fe34
description: 'Behavioral Detection of Unauthorized VNC Remote Control Sessions. (Retargeted to the process_creation auditd telemetry that actually captures this technique''s behavior; see logsource below.) Covers both VNC server-side startup (vncserver/Xvnc/x11vnc), for inbound exposure, and VNC client tool execution (vncviewer/xtightvncviewer/ssvncviewer/remmina), for outbound lateral movement from an already-compromised host. Tune using: ListeningPort, ProcessNameFilter, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1021/005
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.005

logsource:
  category: process_creation
  product: linux

detection:
  selection_server:
    type: EXECVE
    a0|endswith:
      - '/vncserver'
      - '/Xvnc'
      - '/x11vnc'
  selection_client:
    type: EXECVE
    a0|endswith:
      - '/vncviewer'
      - '/xtightvncviewer'
      - '/ssvncviewer'
      - '/remmina'

  condition: 1 of selection_*

falsepositives:
  - 'Legitimate remote-desktop administration via VNC for support purposes, and use of remmina as a general-purpose multi-protocol remote-desktop client (also supports RDP/SSH) for approved administration.'

level: medium

T1021.005 Remote Services: VNC

title: "T1021.005 Remote Services: VNC"
id: 65362d68-17f7-41e6-8914-b111756bf71d
description: 'Behavioral Detection of Unauthorized VNC Remote Control Sessions. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AuthenticationPredicate, TimeWindow, UserActivitySpike.'
references:
  - https://attack.mitre.org/techniques/T1021/005
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.005

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/open'
    CommandLine|contains: 'vnc://'
  selection_screensharing:
    Image|contains: 'Screen Sharing.app'
  condition: 1 of selection*

falsepositives:
  - Help-desk staff or remote-support tools legitimately connecting via VNC to a Mac.

level: medium

Related sub-techniques

Explore