Rare process with VNC server capabilities started
Synopsis
Field
Value
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent
ATT&CK Tactic
Command and Control (TA0011), Lateral Movement (TA0008)
ATT&CK Technique
Remote Access Tools (T1219), Remote Services: VNC (T1021.005)
Severity
Low
Description
A rare process with VNC server capabilities was started.
Attacker's Goals
Accessing a remote machine with full interactive graphic interface capabilities.
Investigative actions
Check if the product usage is approved.
Check if it was executed remotely or locally.
Was this helpful?