VNC Brute Force Login Attempt Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•8

This rule detects a VNC brute force login attempt. It triggers when there are 10 or more TCP connections to port 5900 (the default VNC port) from the same source IP address within a 30-second window, indicating a rapid succession of login attempts.