Remote Management and Monitoring tool - RealVNC - Create Process

Hunt Hypothesis

The detection identifies the use of RealVVC to create processes, which may indicate adversary persistence or command and control activity. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect potential abuse of legitimate remote management tools by adversaries.

KQL Query

let Time_start = now(-5d);
let Time_end = now();
//
DeviceProcessEvents 
| where Timestamp between (Time_start..Time_end)
| where ProcessVersionInfoCompanyName has 'realvnc'
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName

Analytic Rule Definition

id: 865f9d1e-a01a-46b9-a909-2f93fbab5331
name: Remote Management and Monitoring tool - RealVNC - Create Process
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceProcessEvents 
  | where Timestamp between (Time_start..Time_end)
  | where ProcessVersionInfoCompanyName has 'realvnc'
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName

Required Data Sources

Sentinel Table	Notes
`DeviceProcessEvents`	Ensure this data connector is enabled

MITRE ATT&CK Context

Tactic: CommandAndControl
Technique: T1219 — T1219

References

[Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_RealVNC_createproc.yaml)

False Positive Guidance

Scenario: A system administrator is using RealVNC to remotely manage a server and creates a process to install a new software update.
Filter/Exclusion: Check for the presence of known admin credentials or IP addresses associated with the IT helpdesk. Use a filter like:
```
(process.name == "vncviewer") and (src_ip in whitelist) or (user == "admin")
```
Scenario: A scheduled job runs via RealVNC to perform routine system maintenance, such as log cleanup or disk defragmentation.
Filter/Exclusion: Filter based on the process name and command line arguments that are known to be part of legitimate maintenance tasks. Example:
```
(process.name == "vncviewer") and (process.args contains "maintenance")
```
Scenario: An IT team uses RealVNC to remotely configure a firewall rule on a network device, which involves creating a process to modify the firewall configuration.
Filter/Exclusion: Use a filter that checks for known IT team IP ranges or user accounts associated with network administration. Example:
```
(src_ip in it_network_range) or (user == "firewall_admin")
```
Scenario: A RealVNC session is used to deploy a patch via a script that temporarily creates a process to execute the patch installation.
Filter/Exclusion: Filter based on the script path or the presence of a known patch deployment tool. Example:
```
(process.name == "vncviewer") and (process.args contains "patch_deployer.exe")
```
Scenario: A RealVNC session is used to monitor and manage a virtual machine, which involves creating a process to check system health or resource usage.
Filter/Exclusion: Filter based