Analytics BIOC
Low
✕
Rare process with VNC server capabilities started
A rare process with VNC server capabilities was started.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Command and Control (TA0011) Lateral Movement (TA0008)
ATT&CK techniques: Remote Access Tools (T1219) Remote Services: VNC (T1021.005)
Attacker's goals:
Accessing a remote machine with full interactive graphic interface capabilities.
Investigative actions:
Check if the product usage is approved. Check if it was executed remotely or locally.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day