Outbound VNC (RFB protocol) traffic indicative of screen streaming module

Emiliano Mema@Nosalva

•updated Aug 25, 2026•1•0•1

This rule detects the outbound transmission of the Remote Framebuffer (RFB) protocol handshake, which is used by Virtual Network Computing (VNC) software. This is often indicative of unauthorized remote access tools or screen sharing being initiated from a host within the protected network to an external destination.