AutomoxAutomox
Automox Q&ASolved

XDR alerting about hundreds of machines downloading tightvnc

automox_admin_8732
December 16, 2024 at 4:14 pm UTC
#Windows#automox#tightvnc

Hi, our network threat detection system is alerting about hundreds of PCs downloading TightVNC.  The URLs used to conduct these downloads look like this (defanged version): 

hxxps://d1ovafk2iqpmhd[dot]cloudfront[dot]net/automox.com/tightvnc/@v/v2.8.84.windows-amd64.zip

 

Can you please confirm if it is by design for the amagent.exe to download TightVNC even if no admin ever intentionally installed TightVNC on any PCs?  If so, why would this happen if we don’t use TIghtVNC or Automox for remote desktop control?

This discussion is archived and closed to replies. Continue it in the Automox Community Slack.

Discuss on Slack

Replies (2)

MarshypJanuary 13, 2025
#1

Automox uses TightVNC for the remote control console, that said if you’re not using it I am not sure that it should be downloading it - That would need somebody from the team to answer.

 

Should it help, we are NOT seeing TightVNC installed on our clients until the device has a Remote Control session initiated (or initiates one).

automox_admin_8732January 14, 2025
#2

Support said that because the HTTP request being made from our PCs are “HEAD” and not “GET” the file is not actually being downloaded.  They said that this is just the amagent checking to see what the most recent version of TightVNC is.

Back to all discussions