AN0504
Analytic 0504
Windows
Detection of VNC service or executable starting unexpectedly, followed by user session creation and interactive desktop activity (mouse/keyboard simulation).
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4624, 4648
NSM:Flow
port 5900 inbound
[TimeWindow]
Correlate VNC process with user logon activity within defined time span
[VNCBinaryList]
Trackable VNC executable names (e.g., vncserver.exe, winvnc.exe)
[LogonType]
Limit detection to interactive logons (type 10)
AN0505
Analytic 0505
Linux
Spawning of VNC-related processes (e.g., `x11vnc`, `vncserver`) coupled with authentication logs and port listening behavior on TCP 5900.
auditd:EXECVE
None
linux:syslog
None
NSM:Flow
TCP port 5900 open
[ListeningPort]
Default VNC port (5900) but may vary in config
[ProcessNameFilter]
Filter specific VNC binaries in process execution logs
[UserContext]
Scope detection to non-service or high-privilege accounts
AN0506
Analytic 0506
macOS
Detection of VNC-based remote control via `screensharingd` activity in Unified Logs along with concurrent remote login activity or suspicious user interaction.
macos:unifiedlog
authentication
macos:osquery
process_events
NSM:firewall
inbound connection to port 5900
[AuthenticationPredicate]
Unified log predicate to refine suspicious screensharing access
[TimeWindow]
Time between VNC connection and follow-on activity (e.g., 30s)
[UserActivitySpike]
Mouse/keyboard interaction spike immediately post-VNC login