Detect VNC in Google Chronicle

rule detect_vnc_remote_access_t1021_005 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects VNC process execution, TCP connections on ports 5900-5910, and VNC registry key creation — MITRE ATT&CK T1021.005 (Remote Services: VNC)"
    mitre_attack_tactic = "Lateral Movement"
    mitre_attack_technique = "T1021.005"
    severity = "HIGH"
    priority = "HIGH"
    created = "2024-01-01"
    version = "1.0"

  events:
    (
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path,
          `(?i)(vncserver|vncviewer|vncconfig|vnc4server|x0vncserver|tightvncserver|tightvncviewer|ultravnc|uvnc_service|tvnserver|tvnviewer|winvnc|winvnc4|rfbdrv)\.exe`)
      )
      or
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.principal.process.file.full_path,
          `(?i)(vncserver|vncviewer|uvnc_service|tvnserver|winvnc|rfbdrv)\.exe`)
      )
      or
      (
        $e.metadata.event_type = "NETWORK_CONNECTION"
        and $e.target.port >= 5900
        and $e.target.port <= 5910
        and $e.network.ip_protocol = "TCP"
      )
      or
      (
        $e.metadata.event_type = "REGISTRY_CREATION"
        and re.regex($e.target.registry.registry_key,
          `(?i)(RealVNC|TightVNC|UltraVNC|TigerVNC|WinVNC|RFBDRV)`)
      )
      or
      (
        $e.metadata.event_type = "REGISTRY_MODIFICATION"
        and re.regex($e.target.registry.registry_key,
          `(?i)(RealVNC|TightVNC|UltraVNC|TigerVNC|WinVNC|RFBDRV)`)
      )
    )

  condition:
    $e
}