Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1021.005_vnc
Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC).
Passed 8 of 25 test cases with the skill, and 17 of 25 without it.
1 fixed21 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
What is the designated impact category assigned to applicable VNC attack surface findings in an enterprise risk assessment report?
| Checked | Without skill | With skill |
|---|---|---|
| The response states the impact category is Lateral Movement. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1021
Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.
VNC differs from Remote Desktop Protocol as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.
Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.
Platforms: Linux, Windows, macOS
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse ARD to gain remote code execution and perform lateral movement.
References: https://www.mandiant.com/resources/blog/leveraging-apple-remote-desktop-for-good-and-evil
test cases passed, vs 17 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.