Analytics BIOC
Low
✕
Uncommon VNC server communication
Uncommon VNC server network traffic was observed.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Command and Control (TA0011) Lateral Movement (TA0008)
ATT&CK techniques: Remote Access Tools (T1219) Remote Services: VNC (T1021.005)
Attacker's goals:
Accessing a remote machine with full interactive graphic interface capabilities.
Investigative actions:
Check if the product usage is approved. Check if it was executed remotely or locally.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
4 variations:
- Uncommon VNC scanning activity detected from a scanning tool Medium (parent: Low)
- Uncommon VNC server communication from an unmanaged previously unseen external host Low
- Partially uncommon VNC server communication Informational (parent: Low)
- Uncommon VNC server connection Informational (parent: Low)