Applied Cybernetics Group
T1021 Remote Services
- Technique
T1021- Tactics
- Lateral Movement
- Research, 90 days
- 0
- KEV CVEs mapped
- 4
- SigmaHQ rules
- 10
- Elastic, Splunk
- 101
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1021
MITRE description
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to log in using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could log in to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) They could also log in to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation: Kickstart Apple Remote Desktop commands)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
SigmaHQ community rules
- OpenCanary - FTP Login Attempt (core)
- OpenCanary - SMB File Open Request (core)
- OpenCanary - SNMP OID Request (core)
- OpenCanary - SSH Login Attempt (core)
- OpenCanary - SSH New Connection Attempt (core)
- OpenCanary - VNC Connection Attempt (core)
- HackTool - NetExec Execution (core)
- Privilege Escalation via Named Pipe Impersonation (core)
- Potential Remote Desktop Tunneling (core)
- Psexec Execution (core)
Elastic and Splunk rules
- SSH Authorized Keys File Activity (elastic)
- AWS SSM Session Started to EC2 Instance (elastic)
- AWS EC2 Instance Connect SSH Public Key Uploaded (elastic)
- AWS EC2 Instance Console Login via Assumed Role (elastic)
- AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity (elastic)
- Unusual AWS Command for a User (elastic)
- AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (elastic)
- Azure VM Serial Console Connection with Unusual User and ASN (elastic)
- Unusual Azure Activity Logs Event for a User (elastic)
- Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers (elastic)
- SSH Authorized Key File Activity Detected via Defend for Containers (elastic)
- Unusual GCP Event for a User (elastic)
- High Mean of Process Arguments in an RDP Session (elastic)
- High Mean of RDP Session Duration (elastic)
- High Variance in RDP Session Duration (elastic)
- Spike in Number of Connections Made from a Source IP (elastic)
- Spike in Number of Connections Made to a Destination IP (elastic)
- Spike in Number of Processes in an RDP Session (elastic)
- Unusual Time or Day for an RDP Session (elastic)
- ESXi Host Prepared for an Unsigned Install (elastic)
- ESXi SSH Access Enabled (elastic)
- ESXi SSH Session from vpxuser (elastic)
- Linux SSH X11 Forwarding (elastic)
- Potential Internal Linux SSH Brute Force Detected (elastic)
- Successful SSH Authentication from Unusual SSH Public Key (elastic)
Showing 25 of 101.