CVE-2026-65400 Google Chronicle · YARA-L

Detect CVE-2026-65400 — Apple macOS Screen Sharing Improper Authentication Exploitation in Google Chronicle

Detects exploitation attempts and successful abuse of CVE-2026-65400, an improper authentication vulnerability (CWE-287) in Apple macOS Screen Sharing / Remote Management. An unauthenticated remote attacker can bypass authentication on the Screen Sharing (VNC/ARD) service to gain interactive access to a macOS host. This CVE is on the CISA KEV catalog (BOD 26-04). Detection focuses on anomalous inbound Screen Sharing / ARD connections, screensharingd authentication events, unexpected launches of remote-management daemons, and connections from macOS hosts running vulnerable, unpatched builds.

MITRE ATT&CK

Tactic
Initial Access Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_65400_macos_screensharing_auth_bypass {
  meta:
    author = "Argus"
    description = "Inbound Screen Sharing/ARD from public IP to macOS host (CVE-2026-65400)"
    severity = "HIGH"
  events:
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.target.port in %remote_mgmt_ports
    $net.network.direction = "INBOUND"
    net.principal.ip."is_private" = false
    $net.target.hostname = $host
  match:
    $host over 5m
  condition:
    $net
}
high severity medium confidence

Chronicle YARA-L rule matching inbound VNC/ARD connections from public IPs to macOS hosts for CVE-2026-65400.

Data Sources

macOS EDR TelemetryNetwork Connection Logs

Required Tables

udm.events

False Positives & Tuning

  • Authorized Apple Remote Desktop sessions
  • Approved remote support software
  • Security assessment scanning of remote-management ports

Other platforms for CVE-2026-65400

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Enable macOS Screen Sharing service

    Expected signal: launchd loads com.apple.screensharing; screensharingd process starts and begins listening on TCP 5900.

  2. Test 2Enable Apple Remote Desktop / Remote Management

    Expected signal: ARDAgent process activity and a listener on TCP 3283/5900; Remote Management enabled in system preferences.

  3. Test 3Simulate inbound VNC connection to Screen Sharing port

    Expected signal: Inbound TCP connection accepted on port 5900 recorded by host firewall / network sensor with the external source IP.

Last updated: 2026-08-19 Research depth: standard
References (6)

Response Playbook

Triage

  1. Confirm the target macOS host's OS build against the patched builds in Apple advisories HT148170/148171/148172; unpatched builds are exploitable.
  2. Determine whether the source IP of the inbound Screen Sharing/ARD connection is an approved management host or an external/unexpected address.
  3. Review screensharingd unified logs (log show --predicate 'process == "screensharingd"') around the connection time for authentication success without a preceding credential prompt.
  4. Check whether Screen Sharing / Remote Management was expected to be enabled on this host at all.

Containment

  1. Immediately disable Screen Sharing and Remote Management (sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop; sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist).
  2. Block inbound TCP 5900 and 3283 at the host and perimeter firewall for affected hosts.
  3. Isolate the host from the network if unauthorized interactive access is confirmed.

Evidence Collection

  1. Preserve unified logs: sudo log collect --output /tmp/cve65400.logarchive and export screensharingd/ARDAgent entries.
  2. Capture firewall and NetFlow records showing the inbound 5900/3283 session, source IP, and byte counts.
  3. Collect /Library/Logs, /var/log/, current process listing, and any new/modified LaunchAgents/LaunchDaemons for post-access persistence.

Escalation Criteria

  • !Escalate to IR if authentication succeeded from an unapproved or external source IP.
  • !Escalate if post-connection activity shows new user accounts, persistence, credential access, or lateral movement from the host.
  • !Escalate if the affected host is unpatched and internet-exposed on 5900/3283.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >screensharingd and ARDAgent entries in the macOS unified log (log archive)
  • >com.apple.screensharing.plist / com.apple.RemoteManagement launchd state and preferences
  • >Firewall/NetFlow records of inbound 5900/3283 sessions
  • >/var/db/dslocal and account records for any newly created local users

Tuning Guidance

Baseline the set of approved Apple Remote Desktop management hosts and their subnets, then allowlist those source IPs to reduce noise. Prioritize alerts where the source IP is external/public or where screensharingd reports authentication success without an interactive credential prompt. On networks where Screen Sharing is never legitimately used, treat any 5900/3283 inbound acceptance as high fidelity. Confirm affected hosts are unpatched per Apple advisories before raising severity to critical.

Hunting Queries

Hunts for all inbound Screen Sharing/ARD activity across macOS fleet over 30 days to baseline expected admin sources and surface anomalies.

Hunting — KQL
kql 
DeviceNetworkEvents | where Timestamp > ago(30d) | where LocalPort in (5900,3283) and ActionType == "InboundConnectionAccepted" | summarize count(), makeset(RemoteIP) by DeviceName | order by count_ desc
Hunting — SPL
spl 
index=macos (dest_port=5900 OR dest_port=3283 OR process_name=screensharingd) earliest=-30d | stats count values(src_ip) as src_ips by host | sort - count

Atomic Red Team Tests

Test 1 Enable macOS Screen Sharing service
macos

Enables the Screen Sharing (VNC) service on a lab macOS host to generate screensharingd startup telemetry.

Command

bash 
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.screensharing.plist

Cleanup

bash 
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist

Expected Telemetry

launchd loads com.apple.screensharing; screensharingd process starts and begins listening on TCP 5900.

Expected Detection

Process start of screensharingd and a new listener on port 5900 are observed.

Test 2 Enable Apple Remote Desktop / Remote Management
macos

Activates Remote Management via kickstart on a lab macOS host, exercising ARDAgent and port 3283.

Command

bash 
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -restart -agent

Cleanup

bash 
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop

Expected Telemetry

ARDAgent process activity and a listener on TCP 3283/5900; Remote Management enabled in system preferences.

Expected Detection

ARDAgent execution and new remote-management listeners are detected.

Test 3 Simulate inbound VNC connection to Screen Sharing port
linux

From a second lab host, opens a TCP connection to the target's Screen Sharing port to generate an inbound connection event.

Command

bash 
nc -vz TARGET_MAC_IP 5900

Cleanup

bash 
echo 'no cleanup required — connection is transient'

Expected Telemetry

Inbound TCP connection accepted on port 5900 recorded by host firewall / network sensor with the external source IP.

Expected Detection

Inbound Screen Sharing connection from a non-approved source IP triggers the detection.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0008Lateral Movement

Related Techniques

T1021.005VNCT1190Exploit Public-Facing Application

Same Tactic: Initial Access

Popular Detections