As of release 1.15.3, Rumble Network Discovery now detects the TeamViewer protocol on your network in addition to the existing coverage for RDP, VNC, SPICE, and PC Anywhere. This rounds off Rumble's broad support for monitoring remote access solutions.

AD-Controlled RDP is Great, but Unmanaged RDP is a Risk Factor #

Remote Desktop Protocol (RDP) is a useful tool when enabled on a machine that's properly managed on the domain (that is if you're properly managing local accounts). However, RDP can also put you at risk if active on a machine that's not in your domain. It's typically tough to find those, but with Rumble you can.

In your Rumble Console, go to Explore, then scroll down to the Domain Membership Report and select Report Only RDP:

Report on Domain Membership Via RDP

What you should be seeing is a lot of machines that are on your domain and then a long tail of machines that are not part of your domain:

Report on Domain Membership Via RDP

Let's assume that your local domain is "stolpi.local", you can set up a query for all devices that run RDP but are not on your domain as follows:

alive:t and protocol:rdp and not domain:stolpi.local

Report on Domain Membership Via RDP

How to Find Other Rogue Remote Access Solutions on Your Network #

While remote access solutions are not bad per se, you'll want to keep a close eye on the network to ensure that you don't have any rogue remote access solutions running. Let's say your corporate standard is VNC, you'll probably want to find and alert on any RDP and TeamViewer protocols showing up on your network, and getting alerts on new VNC hosts on your network.

Here's how you use Rumble to find remote protocols being used on your network, even if they are running on non-standard ports:

In your Rumble Console, click on Inventory in the left navigation and use the following search queries to find these remote desktop solutions:

  • Microsoft Remote Desktop Protocol: protocol:rdp
  • VNC Viewer: protocol:vnc
  • TeamViewer: protocol:teamviewer
  • SPICE: protocol:spice
  • PC Anywhere: protocol:pca

To find all of these at the same time in Rumble, you can use this query:

protocol:rdp or protocol:vnc or protocol:teamviewer or protocol:spice or protocol:pca

You should be seeing something like this:

Finding Remote Access Solutions on Your Network

Clicking on a random host in this list and scrolling down to the Protocol section, we see that VNC is active on this machine:

Finding VNC on Your Network

Try Finding Remote Access Solutions on Your Network with Rumble #

If you haven't had a chance to try runZero, or would like to find remote access solutions on your internal network, sign up for a free trial and let us know what you think!

Written by runZero Team

Due to the nature of their research and out of respect for their privacy, runZero team members prefer to remain anonymous. Their work is published under the runZero name.

More about runZero Team
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.


Explore more

Webcasts
The Unreasonable Effectiveness of Inside Out Attack Surface Management
HD Moore, founder of runZero (and previously Metasploit), presents new research that will forever redefine how you approach attack surface...
Webcasts
Safeguarding OT/ICS Assets: Insights from the U.S. Department of Energy
Security experts from the National Renewable Energy Lab’s (NREL) Clean Energy Cybersecurity Accelerator™ (CECA) program join runZero to discuss...
runZero Insights
Ensure compliance with DORA’s ICT risk framework using runZero
Learn how to uncover unmanaged and unknown assets— including IT, OT, and IoT— to meet DORA's hidden risk requirements using runZero.
Talks
DEF CON 32: SSHamble: Unexpected Exposures in SSH (Video)
This talk digs deep into SSH, the lesser-known implementations, many of the surprising security issues found along the way, and how to exploit them.

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2025 runZero, Inc. All Rights Reserved