Home/ MITRE Matrix/ Lateral Movement/ T1021.005

T1021.005VNC

T1021.005 — VNC is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 2 detection use cases covering it and 1 threat-intel article citing it.

Lateral Movement

View on the matrix → Filter Detection Library MITRE official spec ↗

2Use cases

1Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1021 · Remote Services

Use cases covering this technique (2)

[LLM] Inbound Screen Sharing (VNC port 5900) from a public IP to a Mac — CVE-2026-65400 exposure Bespoke exploit · hunting DSΣPCS [LLM] macOS screensharingd spawning a shell or downloader as root (post-exploit RCE) Bespoke exploit · alerting DSΣPCS

Articles citing this technique (1)

crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner art-38