NTA Remote Framebuffer Session With Weak Authentication

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects VNC and remote framebuffer sessions, including the authentication method negotiated. RFB is frequently deployed without strong authentication on industrial and legacy systems, and an attacker finding one has interactive desktop access to a machine that often cannot run an endpoint agent at all. Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=nta-authentication-rfb where sourcename='NTA' | groupby srcip, dstip, dstport, authmethod