Detecting and Mitigating VNC Abuse (T1021.005)

Virtual Network Computing, or VNC, lets one person see and control another computer's screen. It is cross-platform, widely installed and often forgotten once the person who set it up has moved on.

MITRE tracks its abuse as VNC, technique T1021.005, in the Lateral Movement tactic. It applies to Linux, macOS and Windows.

How attackers use it

VNC uses the RFB (remote framebuffer) protocol to relay the screen, mouse and keyboard between machines. MITRE draws a useful distinction: VNC is screen sharing software, not resource sharing software like Remote Desktop Protocol. By default VNC uses the system's authentication, though it can be set up with its own credentials.

With a valid account, an adversary can use VNC to act as the logged-on user. MITRE lists opening documents, downloading files and running arbitrary commands. They can also sit and watch the screen to collect information and decide where to go next. MITRE adds that specific VNC libraries and implementations have been open to brute force attacks and memory usage exploitation.

How to detect it

MITRE's strategy (DET0178) gives one analytic per platform family.

• Windows. A VNC service or executable starting unexpectedly, followed by a user session and interactive desktop activity such as simulated mouse and keyboard input.
• Linux. VNC related processes such as x11vnc or vncserver appearing, alongside authentication logs and a listening port on TCP 5900.
• macOS. screensharingd activity in the Unified Logs together with concurrent remote login activity or unusual user interaction.

The default ports are worth knowing: TCP 5900 for the server, 5800 for browser access and 5500 for a viewer in listening mode. Traffic on these ports from places that never used remote desktop tools before is a clear signal.

How to reduce the risk

MITRE lists four mitigations.

1. Uninstall VNC server software wherever it is not required.
2. Filter or block the default VNC ports at the network edge and between internal segments.
3. Inventory workstations for VNC server software nobody approved.
4. Restrict software installation to the groups that need it. A VNC server has to be installed by the user or the adversary, so removing install rights removes that path.

Check your own environment

Read-only checks:

# Linux or macOS: anything listening on the usual VNC ports?
sudo lsof -iTCP -sTCP:LISTEN -n -P | grep -E ':(5900|5800|5500)'

# Windows: listening VNC ports and services that look like VNC
Get-NetTCPConnection -State Listen -LocalPort 5900,5800,5500 -ErrorAction SilentlyContinue
Get-Service | Where-Object { $_.Name -like '*vnc*' -or $_.DisplayName -like '*vnc*' }

Also ask whether your endpoint inventory can list installed remote access software across the fleet. If it cannot, that gap is the finding.

Quick check

Sources

• MITRE ATT&CK, VNC (T1021.005)