← Back to SOC feed Coverage →

Remote Administration toolkit VNC

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-22T09:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential use of a Remote Administration Toolkit (RAT) leveraging VNC protocol for unauthorized remote access. SOC teams should proactively hunt for this behavior to identify and mitigate early-stage adversary activity that could lead to persistent access within Azure Sentinel.

YARA Rule

rule rat_vnc {
    meta:
        author = "x0r"
        description = "Remote Administration toolkit VNC"
	version = "0.1"
    strings:
        $f1 = "ultravnc.ini" nocase
        $c2 = "StartVNC"
        $c3 = "StopVNC"
    condition:
        any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/capabilities/capabilities.yar