Use of UltraVNC Remote Access Software

Title: Use of UltraVNC Remote Access Software
Status: test
Description:An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1219/T1219.md
Author: frack113
Date: 2022-10-02
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1219.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Description:'VNCViewer' Product:'UltraVNC VNCViewer' Company:'UltraVNC' OriginalFileName:'VNCViewer.exe'   condition:selection
Falsepositives:
  -Legitimate use
Level: medium