Detect VNC server or viewer process starting on a host

Siemphony@siemphonymediumT1021.005unverifiedPlaybook · Lateral movement

Flags process creation of known VNC server and viewer executables, the first observable in MITRE's chain of "VNC service starting unexpectedly, followed by user session creation and interactive desktop activity". The binary list is MITRE's VNCBinaryList tuning knob made concrete, matched on `Image` alone so the rule stays a single-field match that every backend can render. Viewer binaries are included because a host initiating an outbound VNC session is the lateral-movement source, not just the target. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0178, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Detect VNC server or viewer process starting on a host2id: 6959d9b5-4a5f-43e8-af26-bdafc2882ddd3status: experimental4description: |5  Flags process creation of known VNC server and viewer executables, the first6  observable in MITRE's chain of "VNC service starting unexpectedly, followed by7  user session creation and interactive desktop activity". The binary list is8  MITRE's VNCBinaryList tuning knob made concrete, matched on `Image` alone so9  the rule stays a single-field match that every backend can render. Viewer10  binaries are included because a host initiating an outbound VNC session is the11  lateral-movement source, not just the target.12  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0178, not hand-written and not tested by its author. Any lab result is on this rule's own page.13references:14  - https://attack.mitre.org/techniques/T1021/00515  - https://attack.mitre.org/detectionstrategies/DET017816author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)17date: 2026-08-1618tags:19  - attack.lateral-movement20  - attack.t1021.00521logsource:22  category: process_creation23  product: windows24detection:25  selection:26    Image|endswith:27      - '\winvnc.exe'28      - '\winvnc4.exe'29      - '\vncserver.exe'30      - '\vncserverui.exe'31      - '\vncviewer.exe'32      - '\tvnserver.exe'33      - '\tvnviewer.exe'34      - '\uvnc_service.exe'35  condition: selection36falsepositives:37  - "Sanctioned remote-support tooling — helpdesk staff launching UltraVNC or TightVNC against user workstations produces exactly this event. Narrow MITRE's VNCBinaryList to the products your estate does not license, or exclude the helpdesk operators named by the UserContext knob."38  - "VNC service auto-start at boot on hosts where a KVM-over-IP, lab-imaging or remote-console agent bundles a VNC server; the process appears under SYSTEM on every reboot with no accompanying interactive logon."39  - "Installers and updaters for VNC packages, which run the server binary once to register the service during a software deployment window."40level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\winvnc.exe" or FolderPath endswith "\\winvnc4.exe" or FolderPath endswith "\\vncserver.exe" or FolderPath endswith "\\vncserverui.exe" or FolderPath endswith "\\vncviewer.exe" or FolderPath endswith "\\tvnserver.exe" or FolderPath endswith "\\tvnviewer.exe" or FolderPath endswith "\\uvnc_service.exe")

Splunk · SPL

Run this as a search.

index=* (Image="*\\winvnc.exe" OR Image="*\\winvnc4.exe" OR Image="*\\vncserver.exe" OR Image="*\\vncserverui.exe" OR Image="*\\vncviewer.exe" OR Image="*\\tvnserver.exe" OR Image="*\\tvnviewer.exe" OR Image="*\\uvnc_service.exe")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\winvnc.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winvnc4.exe" OR TO_LOWER(process.executable) LIKE "*\\\\vncserver.exe" OR TO_LOWER(process.executable) LIKE "*\\\\vncserverui.exe" OR TO_LOWER(process.executable) LIKE "*\\\\vncviewer.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tvnserver.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tvnviewer.exe" OR TO_LOWER(process.executable) LIKE "*\\\\uvnc_service.exe")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\winvnc\.exe$|\\winvnc4\.exe$|\\vncserver\.exe$|\\vncserverui\.exe$|\\vncviewer\.exe$|\\tvnserver\.exe$|\\tvnviewer\.exe$|\\uvnc_service\.exe$)</field>    <description>Detect VNC server or viewer process starting on a host</description>    <mitre>      <id>T1021.005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 6959d9b5-4a5f-43e8-af26-bdafc2882ddd

ATT&CKT1021.005

T1021.005VNC

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1021.005, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Cut the binary list down to the products your estate does not license. A
Exclude the boot and install cases by ParentImage (services.exe,
Reach for the second link: MITRE's LogonType knob says scope to interactive
MITRE's UserContext knob appears under AN0505, the Linux analytic — the

Declared by the author

Sanctioned remote-support tooling — helpdesk staff launching UltraVNC or TightVNC against user workstations produces exactly this event. Narrow MITRE's VNCBinaryList to the products your estate does not license, or exclude the helpdesk operators named by the UserContext knob.
VNC service auto-start at boot on hosts where a KVM-over-IP, lab-imaging or remote-console agent bundles a VNC server; the process appears under SYSTEM on every reboot with no accompanying interactive logon.
Installers and updaters for VNC packages, which run the server binary once to register the service during a software deployment window.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

Process creation of a known VNC server or viewer binary on a Windows host. MITRE's analytic AN0504 describes a three-link chain: "VNC service or executable starting unexpectedly, followed by user session creation and interactive desktop activity". Sigma has no sequence operator and no time window, so this rule takes the first link only — it tells you a VNC process started, not that anyone used it to drive the desktop. The two links it cannot reach are where the evidence of remote control actually lives. Server and viewer binaries are both in scope. A host launching vncviewer.exe is the origin of the lateral movement rather than its target, and origin telemetry is the half defenders most often forget to collect.

02 · Telemetry you need

Sysmon EventID 1 from workstations, not just servers — the viewer half of this
A Sysmon config whose ProcessCreate exclusions do not blank out
Image carrying a full path. On Security 4688 the equivalent field is
To grow past the precursor: Security 4624 and 4648 with LogonType.

03 · How the logic works

One selection, one field, one modifier:

That list is MITRE's VNCBinaryList knob written out as literals — the brief names the knob and gives two examples, and the author expanded it across the three implementations most common on Windows. endswith rather than a full path is deliberate. VNC installs under Program Files, Program Files (x86), per-user directories, and — in the case that matters — wherever an operator dropped a portable copy. Pinning the install path would miss exactly the adversary variant. The leading \ inside each value does the work a bare contains would not: it forces a path separator immediately before the filename, so mycompany-vncviewer.exe and vncviewer.exe.log do not match. Everything sits on Image alone. That is a backend decision as much as a detection one — OR-ing across two different fields is what makes Wazuh refuse a rule, and translations.json records no refusals here.

04 · Common false positives

Sanctioned remote support. Helpdesk staff running UltraVNC or TightVNC against
VNC servers bundled inside KVM-over-IP, lab imaging or remote console agents,
Installers and updaters that invoke the server binary once to register its

05 · Detection maturity

tier_1: , and no higher.** UNVERIFIED — derived from MITRE ATT&CK DET0178 and never executed against a single log line. Nobody has confirmed the field is populated in your pipeline, that the binary names match your estate, or that it fires at all.
tier_2: run it over historical process-creation data, confirm the volume is non-zero and survivable, and replace the generic binary list with the products actually absent from your software inventory.
tier_3: needs the correlation — VNC process start joined to a type 10 logon inside MITRE's TimeWindow — which lives outside Sigma entirely.

Related detections5 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/6959d9b5-4a5f-43e8-af26-bdafc2882ddd

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect VNC server or viewer process starting on a host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it