Detecting VNC services installed/running

[mjomha]

Description: Looks for the VNC service running on machines. This is used often when attackers gain access to a machine, running VNC to allow them to interactively access a machine.
What The Data Shows: VNC service is running on a machine.
SQL:
SELECT display_name,status,s.pid,p.path
FROM services AS s
JOIN processes AS p
USING(pid)
WHERE s.name LIKE "%vnc%";

[jnelson]

@mjomha would you consider adding a join to the processes table to get the path?

SELECT display_name,status,s.pid,p.path

FROM services AS s

JOIN processes AS p

    USING(pid)

WHERE s.name LIKE "%vnc%";

[mjomha]

Thanks!

I was aiming to just find vnc service running on machines if an environment does not use vnc at all but in cases where vnc might possibly be legitimately used in an environment having the path would help identify if it’s legit or maliciously being used.