TA0008 · LATERAL MOVEMENT
VNC
Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC).
Detect it with
Use of VNC may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior using VNC.
Why it matters on shift
VNC is one of the concrete ways adversaries achieve lateral movement. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After lateral movement, the next tactic is usually Collection. Search your telemetry for the transition before closing the ticket.
Kill-chain context