tfMITRE ATT&CK sub-technique

VNC T1021.005

Tactic: Lateral Movement
Platforms: Linux, Windows, macOS
Version: 1.2
Created: 11 February 2020
Last modified: 24 October 2025

Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

VNC MITRE reference T1021.005

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Fox KittenG0117 ↗

Has installed TightVNC server and client on compromised servers and endpoints for lateral movement.1

created 2020-12-211 referenceaka UNC757

Gamaredon GroupG0047 ↗

Has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.1 2 3

created 2017-05-313 referencesaka IRON TILDEN

FIN7G0046 ↗

Has used TightVNC to control compromised hosts.1

created 2017-05-311 referenceaka GOLD NIAGARA

GCMANG0036 ↗

Uses VNC for lateral movement.1

created 2017-05-311 reference

All 4 groups for this technique

Offense vs defense T1021.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2022 Q1

VNC detection strategy DET0178

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Unauthorized VNC Remote Control Sessions

Enterprise

3 platforms

AN0504 · Windows

Detection of VNC service or executable starting unexpectedly, followed by user session creation and interactive desktop activity (mouse/keyboard simulation).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Traffic FlowDC0078	NSM:Flow	port 5900 inbound

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlate VNC process with user logon activity within defined time span
VNCBinaryList	Trackable VNC executable names (e.g., vncserver.exe, winvnc.exe)
LogonType	Limit detection to interactive logons (type 10)

AN0505 · Linux

Spawning of VNC-related processes (e.g., x11vnc, vncserver) coupled with authentication logs and port listening behavior on TCP 5900.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	None
Network Traffic FlowDC0078	NSM:Flow	TCP port 5900 open
Logon Session MetadataDC0088	linux:syslog	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ListeningPort	Default VNC port (5900) but may vary in config
ProcessNameFilter	Filter specific VNC binaries in process execution logs
UserContext	Scope detection to non-service or high-privilege accounts

AN0506 · macOS

Detection of VNC-based remote control via screensharingd activity in Unified Logs along with concurrent remote login activity or suspicious user interaction.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Logon Session CreationDC0067	macos:unifiedlog	authentication
Network Traffic FlowDC0078	NSM:firewall	inbound connection to port 5900

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthenticationPredicate	Unified log predicate to refine suspicious screensharing access
TimeWindow	Time between VNC connection and follow-on activity (e.g., 30s)
UserActivitySpike	Mouse/keyboard interaction spike immediately post-VNC login

Tests1Executorssh 1Need elevation1 of 1Have prerequisites0Have cleanup1Platformsmacos

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Enable Apple Remote Desktop Agent	macos	sh	Required	—	Yes
ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse ARD to gain remote code execution and perform lateral movement. References: https://www.mandiant.com/resources/blog/leveraging-apple-remote-desktop-for-good-and-evil Attack command sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -quiet Cleanup command sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop -configure -privs -none -quiet GUID224e7e53-b0cc-4ccd-a6b3-268f8d45f9cc

Tests from Atomic Red Team (MIT licence) · technique definition

VNC detections T1021.005

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs