Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
12
5
4
2
1
Contributors
7
5
3
2
2
Categories
13
10
7
5
3
Platforms
10
8
4
3
Products / Services
4
2
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
2
1
IDS Classtypes
3
1
IDS Protocols
4
Detects VNC and remote framebuffer sessions, including the authentication method
negotiated. RFB is frequently deployed without strong authentication on industrial
and legacy systems, and an attacker finding one has interactive desktop access to a
machine that often cannot run an endpoint agent at all.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-rfb where sourcename='NTA'
| groupby srcip, dstip, dstport, authmethod
negotiated. RFB is frequently deployed without strong authentication on industrial
and legacy systems, and an attacker finding one has interactive desktop access to a
machine that often cannot run an endpoint agent at all.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-rfb where sourcename='NTA'
| groupby srcip, dstip, dstport, authmethod
CVE-2026-65400 affects the macOS Screen Sharing service and can allow an attacker on the network to authenticate without valid credentials. Huntress' research goes further, describing the pre-authentication path and opportunities to obtain root-level file access and ultimately code execution. First thing first: patch. Update affected devices to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Apple released these versions on August 6 to address CVE-2026-65400. If patching is not immediately possible, disable Screen Sharing. After patching, we still need to answer the hunter's question: was any of this activity already happening before the update? The KQL below hunts across Microsoft Defender XDR telemetry for activity around the observed attack path: Screen Sharing file activity, SSH sessions, privileged file writes, LaunchDaemon persistence, process masquerading, Packet Filter changes, XMRig artefacts and related network activity. One process particularly worth reviewing is SSFileCopyReceiver / SSFileCopySender. Huntress notes that these are privileged Screen Sharing helpers, and their research highlights root-context activity and filesystem operations as useful hunting opportunities.
Detects SSFileCopySender/SSFileCopyReceiver helpers running as uid=0 reading or writing sensitive system paths during Screen Sharing sessions using legacy VNC auth or lacking a preceding valid local logon — abuse of the root file-copy primitive underlying CVE-2026-65400.
This rule detects the outbound transmission of the Remote Framebuffer (RFB) protocol handshake, which is used by Virtual Network Computing (VNC) software. This is often indicative of unauthorized remote access tools or screen sharing being initiated from a host within the protected network to an external destination.
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
Detects attempts to inject shell metacharacters or command substitution into VNC-related operations, specifically targeting the 'start vnc' command within network connection URLs or process command lines. This rule aims to identify potential command injection vulnerabilities being exploited.
Detects attempts to inject shell metacharacters or command substitution into VNC-related operations, specifically targeting the 'start vnc' command within network connection URLs or process command lines. This rule aims to identify potential command injection vulnerabilities being exploited.
Detects VNC connections used for visual remote desktop lateral movement
This rule detects a VNC brute force login attempt. It triggers when there are 10 or more TCP connections to port 5900 (the default VNC port) from the same source IP address within a 30-second window, indicating a rapid succession of login attempts.
This rule detects attempts to establish a VNC (Virtual Network Computing) connection on TCP port 5901, which is an alternative port often used for VNC. The detection is based on the presence of the 'RFB 00' string, which is part of the VNC protocol handshake, within the initial bytes of an established TCP connection flowing to the server.
Detects VNC remote service access from external IP addresses
This rule detects attempts to establish a VNC (Virtual Network Computing) remote desktop session to a host on the protected network. It specifically looks for TCP traffic destined for port 5900 (the default VNC port) and the presence of the 'RFB 00' string within the initial bytes of the connection, which is characteristic of the VNC RFB (Remote Framebuffer) protocol handshake.
Linux VNC Install
Sigma
Detects VNC-based lateral movement activities. Looking for the initial install
Detects VNC-based activities. Looking for specific VNC processes
This rule detects VNC-based lateral movement activities within an internal network (East-West traffic).
Linux VNC Install
Sigma
Detects VNC-based lateral movement activities. Looking for the initial install
The rule detects VNC (Virtual Network Computing) application usage on Windows systems, looking for specific indicators in conjunction.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
Detects VNC-based lateral movement activities. East to West traffic
Detects VNC-based activities. Looking for specific VNC processes
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
Page 1 of 2