Remote Management and Monitoring tool - RealVNC - Network Connection

Hunt Hypothesis

The detection identifies potential use of RealVVC as a remote management tool by adversaries establishing unauthorized network connections for command and control. SOC teams should proactively hunt for this behavior to detect and mitigate persistent threats leveraging RMM tools for C2 in their Azure Sentinel environment.

KQL Query

let Time_start = now(-5d);
let Time_end = now();
//
DeviceNetworkEvents
| where Timestamp between (Time_start..Time_end)
| where RemoteUrl has_any (
        'update-check.realvnc.com',
        'services.vnc.com'
    )
    and InitiatingProcessVersionInfoCompanyName has 'realvnc'
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
    RemoteUrl 

Analytic Rule Definition

id: b27b5b31-4cdf-4c1a-87f9-10c127f2570d
name: Remote Management and Monitoring tool - RealVNC - Network Connection
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceNetworkEvents
  | where Timestamp between (Time_start..Time_end)
  | where RemoteUrl has_any (
          'update-check.realvnc.com',
          'services.vnc.com'
      )
      and InitiatingProcessVersionInfoCompanyName has 'realvnc'
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
      RemoteUrl 

Required Data Sources

MITRE ATT&CK Context

• Tactic: CommandAndControl
• Technique: T1219 — T1219

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_RealVNC_netconn.yaml)

False Positive Guidance

• Scenario: Scheduled System Maintenance via RealVNC
  Description: An administrator schedules a maintenance task using RealVNC to remotely reboot or update a server.
  Filter/Exclusion: process.name != "RealVNC" OR process.parent.name != "Task Scheduler"

• Scenario: Remote Desktop Administration with RealVNC
  Description: A system administrator uses RealVNC to perform routine remote desktop administration tasks on a corporate endpoint.
  Filter/Exclusion: process.name != "RealVNC" OR user.account != "admin_account"

• Scenario: RealVNC Used for Remote Software Deployment
  Description: IT uses RealVNC to deploy software updates to multiple endpoints across the network.
  Filter/Exclusion: process.name != "RealVNC" OR process.parent.name != "Deployment Tool"

• Scenario: RealVNC Used for Remote Monitoring of Network Devices
  Description: Network administrators use RealVNC to monitor and manage network devices like routers or switches.
  Filter/Exclusion: process.name != "RealVNC" OR destination.port != 5900

• Scenario: RealVNC Used for Remote Support by Help Desk
  Description: The help desk uses RealVNC to provide remote support to end-users.
  Filter/Exclusion: process.name != "RealVNC" OR user.account != "helpdesk_account"