ATT&CK T1133 - VNC Access Attempt from External

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects an attempt to establish a VNC (Virtual Network Computing) connection from an external source to a host within the protected network. It specifically looks for TCP SYN packets (initial connection attempt) destined for common VNC ports (5900-5910) on the home network. This could indicate an attacker attempting to gain remote access to internal systems.