Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1021.005: VNC

Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.[1]

VNC differs from Remote Desktop Protocol as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.[2][3]

Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.[4][5][6][7][8][9]

EnterpriseT1021.005Sub-techniqueObject v1.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

VNC matters because it can turn a valid login into full interactive control of a workstation or server across Windows, Linux, and macOS. For leaders, the risk is not just “remote access exists”; it is whether the organization can prove VNC is approved, patched, restricted, logged, and distinguishable from unauthorized screen-control activity during an incident.

Executive priority

Prioritize this where remote administration is allowed, where shared desktops support operations, or where high-value systems could be controlled as a logged-on user. Governance questions should include: which VNC implementations are approved, who may use them, whether VNC-specific credentials exist outside centralized identity controls, whether lateral VNC traffic is filtered, and whether audit evidence can show unauthorized remote-control sessions. This supports resilience, compliance readiness, and incident decision-making because VNC abuse can enable hands-on actions such as opening documents, downloading files, running commands, monitoring users, and pivoting further inside the network.

Technical view

ATT&CK places VNC under Remote Services for lateral movement. The supplied description ties the behavior to Valid Accounts and the RFB remote framebuffer protocol, with platform scope across Linux, Windows, and macOS. Because MITRE provides no official detection text, SOC and detection engineering teams should validate coverage against the related detection strategy DET0178, “Behavioral Detection of Unauthorized VNC Remote Control Sessions,” and build local logic around authorized-use baselines, unexpected VNC services, remote-control session evidence, authentication events, and lateral network connections. IR teams should treat observed VNC activity as both an identity question and an endpoint-control question: determine the account used, whether authentication was system-based or VNC-specific, what host was controlled, and what user-context actions occurred during the session.

Likely telemetry

  • Network flow and firewall logs showing RFB/VNC remote-control connections between hosts
  • Endpoint service, process, and installed-software inventory identifying VNC servers or clients
  • Authentication logs for system accounts and any VNC-specific credential mechanisms
  • Session or remote-login records, including macOS unified log evidence where available
  • Endpoint activity around files opened, downloads, commands run, and interactive user-context actions during remote-control windows

Detection direction

  • Create an allowlist of approved VNC use cases, servers, administrators, and source networks; alert on deviations rather than treating all screen sharing as malicious.
  • Correlate VNC/RFB network activity with successful authentication, endpoint process/service state, and expected change or support tickets to reduce false positives from legitimate administration.
  • Hunt for newly enabled VNC services, unapproved VNC software, or VNC-specific credentials that bypass normal identity governance.
  • Review lateral movement context: VNC use after suspicious credential activity or from unusual internal hosts should receive higher priority.
  • Account for blind spots: MITRE provides no official detection procedure for this technique, and visibility can be weak if network logs lack east-west coverage, endpoints do not record service state, or VNC authentication is separate from centralized system authentication.

Mitigation priorities

  • First, remove or disable unnecessary VNC services and remote-control features, aligning with M1042 Disable or Remove Feature or Program.
  • Second, restrict installation of unauthorized VNC tools using software control and least-privilege practices, aligning with M1033 Limit Software Installation.
  • Third, filter ingress, egress, and lateral VNC traffic so only approved administrative paths are allowed, aligning with M1037 Filter Network Traffic.
  • Fourth, audit VNC configuration, authentication mode, enabled services, installed versions, and usage history, aligning with M1047 Audit.
  • Finally, include VNC in incident response playbooks: validate account exposure, session timeline, controlled host actions, and whether further pivoting occurred.
Analyst notes and limits

This technique is a sub-technique of T1021 Remote Services and is specifically scoped to VNC-based remote control over Linux, Windows, and macOS. The object highlights Valid Accounts, possible use of system authentication or VNC-specific credentials, and historical concerns around brute force and implementation vulnerabilities. Relationship context includes one detection strategy, four mitigations, and several groups/software entries that use the technique; these support prioritization but should not be interpreted as evidence of activity in any given environment.

No official MITRE detection text is supplied for this object. The ATT&CK fields do not provide vendor-specific log sources, default ports, analytic logic, or guaranteed indicators. Local environment data is required to distinguish approved remote administration from unauthorized VNC control and to assess exposure to specific VNC implementations or vulnerabilities.

Official MITRE ATT&CK definition

VNC

Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.[1]

VNC differs from Remote Desktop Protocol as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.[2][3]

Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.[4][5][6][7][8][9]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1021 Remote Services This object subtechnique of Remote Services.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Group Enterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

Group Enterprise

G0036: GCMAN

GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. [1]

Group Enterprise

G0117: Fox Kitten

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]

Malware Enterprise

S0412: ZxShell

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly from Chinese hacker websites. It has been used since at least 2004.[1][2]

Windows
Malware Enterprise

S0484: Carberp

Carberp is a credential and information stealing malware that has been active since at least 2009. Carberp's source code was leaked online in 2013, and subsequently used as the foundation for the Carbanak backdoor.[1][2][3]

Windows
Malware Enterprise

S0266: TrickBot

TrickBot is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to Dyre. TrickBot was developed and initially used by Wizard Spider for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of "big game hunting" ransomware campaigns.[1][2][3][4]

Windows
Malware Enterprise

S0670: WarzoneRAT

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]

Windows
Malware Enterprise

S1160: Latrodectus

Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. Latrodectus has most often been distributed through email campaigns, primarily by TA577 and TA578, and has infrastructure overlaps with historic IcedID operations.[1][2][3]

Windows
Relationship explorer

All related ATT&CK context

mitigates · Mitigation M1042: Disable or Remove Feature or Program Enterprise uses · Malware S0412: ZxShell Enterprise uses · Group G0047: Gamaredon Group Enterprise uses · Group G0046: FIN7 Enterprise uses · Malware S1014: DanBot Enterprise uses · Malware S0484: Carberp Enterprise uses · Group G0036: GCMAN Enterprise uses · Group G0117: Fox Kitten Enterprise uses · Malware S0266: TrickBot Enterprise uses · Malware S0279: Proton Enterprise subtechnique of · Technique T1021: Remote Services Enterprise mitigates · Mitigation M1037: Filter Network Traffic Enterprise mitigates · Mitigation M1047: Audit Enterprise uses · Malware S0670: WarzoneRAT Enterprise detects · Detection Strategy DET0178: Behavioral Detection of Unauthorized VNC Remote Control Sessions Enterprise mitigates · Mitigation M1033: Limit Software Installation Enterprise uses · Malware S1160: Latrodectus Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1042: Disable or Remove Feature or Program

Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

- Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash). - Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

- Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required. - Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

- Use Case: Prevent users from installing unauthorized software via group policies or other management tools. - Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

- Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices. - Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

- Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes. - Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

Mitigation Enterprise

M1037: Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Mitigation Enterprise

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

Mitigation Enterprise

M1033: Limit Software Installation

Prevent users or groups from installing unauthorized or unapproved software to reduce the risk of introducing malicious or vulnerable applications. This can be achieved through allowlists, software restriction policies, endpoint management tools, and least privilege access principles. This mitigation can be implemented through the following measures:

Application Whitelisting

- Implement Microsoft AppLocker or Windows Defender Application Control (WDAC) to create and enforce allowlists for approved software. - Whitelist applications based on file hash, path, or digital signatures.

Restrict User Permissions

- Remove local administrator rights for all non-IT users. - Use Role-Based Access Control (RBAC) to restrict installation permissions to privileged accounts only.

Software Restriction Policies (SRP)

- Use GPO to configure SRP to deny execution of binaries from directories such as `%AppData%`, `%Temp%`, and external drives. - Restrict specific file types (`.exe`, `.bat`, `.msi`, `.js`, `.vbs`) to trusted directories only.

Endpoint Management Solutions

- Deploy tools like Microsoft Intune, SCCM, or Jamf for centralized software management. - Maintain a list of approved software, versions, and updates across the enterprise.

Monitor Software Installation Events

- Enable logging of software installation events and monitor Windows Event ID 4688 and Event ID 11707 for software installs. - Use SIEM or EDR tools to alert on attempts to install unapproved software.

Implement Software Inventory Management

- Use tools like OSQuery or Wazuh to scan for unauthorized software on endpoints and servers. - Conduct regular audits to detect and remove unapproved software.

*Tools for Implementation*

Application Whitelisting:

- Microsoft AppLocker - Windows Defender Application Control (WDAC)

Endpoint Management:

- Microsoft Intune - SCCM (System Center Configuration Manager) - Jamf Pro (macOS) - Puppet or Ansible for automation

Software Restriction Policies:

- Group Policy Object (GPO) - Microsoft Software Restriction Policies (SRP)

Monitoring and Logging:

- Splunk - OSQuery - Wazuh (open-source SIEM and XDR) - EDRs

Inventory Management and Auditing:

- OSQuery - Wazuh

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
a582787ba852cd72...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.2 Current bundle a582787ba852…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    The Remote Framebuffer Protocol

    T. Richardson, J. Levine, RealVNC Ltd.. (2011, March). The Remote Framebuffer Protocol. Retrieved September 20, 2021.

    Open source URL
  2. [2]
    MacOS VNC software for Remote Desktop

    Apple Support. (n.d.). Set up a computer running VNC software for Remote Desktop. Retrieved August 18, 2021.

    Open source URL
  3. [3]
    VNC Authentication

    Tegan. (2019, August 15). Setting up System Authentication. Retrieved September 20, 2021.

    Open source URL
  4. [4]
    Hijacking VNC

    Z3RO. (2019, March 10). Day 70: Hijacking VNC (Enum, Brute, Access and Crack). Retrieved September 20, 2021.

    Open source URL
  5. [5]
    macOS root VNC login without authentication

    Nick Miles. (2017, November 30). Detecting macOS High Sierra root account without authentication. Retrieved September 20, 2021.

    Open source URL
  6. [6]
    VNC Vulnerabilities

    Sergiu Gatlan. (2019, November 22). Dozens of VNC Vulnerabilities Found in Linux, Windows Solutions. Retrieved September 20, 2021.

    Open source URL
  7. [7]
    Offensive Security VNC Authentication Check

    Offensive Security. (n.d.). VNC Authentication. Retrieved October 6, 2021.

    Open source URL
  8. [8]
    Attacking VNC Servers PentestLab

    Administrator, Penetration Testing Lab. (2012, October 30). Attacking VNC Servers. Retrieved October 6, 2021.

    Open source URL
  9. [9]
    Havana authentication bug

    Jay Pipes. (2013, December 23). Security Breach! Tenant A is seeing the VNC Consoles of Tenant B!. Retrieved September 12, 2024.

    Open source URL
  10. [10]
    Apple Unified Log Analysis Remote Login and Screen Sharing

    Sarah Edwards. (2020, April 30). Analysis of Apple Unified Logs: Quarantine Edition [Entry 6] – Working From Home? Remote Logins. Retrieved August 19, 2021.

    Open source URL
  11. [11]
    Gnome Remote Desktop grd-settings

    Pascal Nowack. (n.d.). Retrieved September 21, 2021.

    Open source URL
  12. [12]
    Gnome Remote Desktop gschema

    Pascal Nowack. (n.d.). Retrieved September 21, 2021.

    Open source URL
  13. [13]
    mitre-attack T1021.005
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use