RFB/VNC ProtocolVersion Banner Sent by Internal Host (Handshake Stage 1)

Duo Tech@duotech

•updated Aug 17, 2026•1•0•11

Detects completed RFB/VNC protocol handshakes to internal macOS Screen Sharing hosts (TCP/5900) from external networks, thresholded to separate reconnaissance/scanning from single stray connections. Early-warning exposure signal for CVE-2026-65400 targeting.