Techniques › T1021.005 › AN0504
AN0504 Analytic 0504
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of VNC service or executable starting unexpectedly, followed by user session creation and interactive desktop activity (mouse/keyboard simulation).</p>
- Detects
- T1021.005 VNC
- Part of
- DET0178 Behavioral Detection of Unauthorized VNC Remote Control Sessions
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
| NSM:Flow | port 5900 inbound | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlate VNC process with user logon activity within defined time span |
VNCBinaryList | Trackable VNC executable names (e.g., vncserver.exe, winvnc.exe) |
LogonType | Limit detection to interactive logons (type 10) |