VNC Alt Port Remote Desktop Access Attempt

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•7

This rule detects attempts to establish a VNC (Virtual Network Computing) connection on TCP port 5901, which is an alternative port often used for VNC. The detection is based on the presence of the 'RFB 00' string, which is part of the VNC protocol handshake, within the initial bytes of an established TCP connection flowing to the server.