huntrule

OpenCanary - VNC Connection Attempt on Instrumented Node

Alerts when OpenCanary records a VNC service connection attempt on an instrumented node.

FreeUnreviewedSigmahighv1
title: OpenCanary - VNC Connection Attempt on Instrumented Node
id: e20f4314-064d-4268-b9d5-6cdf97d14323
status: test
description: This rule flags events where an OpenCanary node reports a VNC connection attempt. Attackers may use VNC to gain remote interactive access or as part of lateral movement. The detection relies on OpenCanary application telemetry where VNC activity is logged with logtype 12001.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_vnc_connection_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.lateral-movement
  - attack.t1021
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 12001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 9db5446c-b44a-4291-8b89-fcab5609c3b3
    type: derived

What it detects

This rule flags events where an OpenCanary node reports a VNC connection attempt. Attackers may use VNC to gain remote interactive access or as part of lateral movement. The detection relies on OpenCanary application telemetry where VNC activity is logged with logtype 12001.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.