Cross-source coverage

T1021 / ATT&CK

Remote Services

352 rules · 346 families across 12 sources.

10 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter.

Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.

Platforms
Linux · macOS · Windows · IaaS · ESXi
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonlinux:syslogauditd:SYSCALLmacos:unifiedlogmacos:osqueryAWS:CloudTrailAWS:VPCFlowLogsesxi:vmkernelesxi:shell

How MITRE says to detect it DET0269

Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity

Windows Analytic 0750

Logon via RDP or WMI by a user account followed by uncommon command execution, file manipulation, or lateral network connections.

  • WinEventLog:Security EventCode=4624, 4648
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=3, 22

Linux Analytic 0751

SSH session from new source IP followed by interactive shell or privilege escalation (e.g., sudo, su) and outbound lateral connection.

  • linux:syslog sshd: Accepted password/publickey
  • auditd:SYSCALL execve, USER_CMD

macOS Analytic 0752

Remote login via ARD or SSH followed by screensharingd process activity or modification of TCC-protected files.

  • macos:unifiedlog eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate'
  • macos:osquery process_events

IaaS Analytic 0753

Use of cloud-based bastion or VM console session followed by commands that initiate outbound SSH or RDP sessions from the cloud instance to other environments.

  • AWS:CloudTrail AWS ConsoleLogin, StartSession
  • AWS:VPCFlowLogs Outbound connections to port 22, 3389

ESXi Analytic 0754

vSphere API logins (vimService) or SSH to ESXi host followed by unauthorized shell commands or lateral remote logins from the ESXi host.

  • esxi:vmkernel vim.fault.*, DCUI login, SSH shell
  • esxi:shell Command execution trace

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 352 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

92 rules
Detection Severity Format
CobaltStrike Service Installations - System Critical Sigma
Potential DCOM InternetExplorer.Application DLL Hijack Critical Sigma
Potential DCOM InternetExplorer.Application DLL Hijack - Image Load Critical Sigma
Turla Group Lateral Movement Critical Sigma
Wmiprvse Wbemcomn DLL Hijack - File Critical Sigma
BaaUpdate.exe Suspicious DLL Load High Sigma
CobaltStrike Service Installations - Security High Sigma
DCOM InternetExplorer.Application Iertutil DLL Hijack - Security High Sigma
First Time Seen Remote Named Pipe High Sigma
First Time Seen Remote Named Pipe - Zeek High Sigma

+ 82 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

88 rules
Detection Severity Format
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization High Elastic TOML
AWS EC2 Instance Connect SSH Public Key Uploaded High Elastic TOML
AWS EC2 Instance Console Login via Assumed Role High Elastic TOML
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity High Elastic TOML
AWS SSM Session Started to EC2 Instance High Elastic TOML
Execution via TSClient Mountpoint High Elastic TOML
Incoming DCOM Lateral Movement via MSHTA High Elastic TOML
Incoming DCOM Lateral Movement with MMC High Elastic TOML
Lateral Movement via Startup Folder High Elastic TOML
Potential Direct Kubelet Access via Process Arguments High Elastic TOML

+ 78 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

64 rules
Detection Severity Format
Allow Inbound Traffic By Firewall Rule Registry Undefined SPL
Allow Inbound Traffic In Firewall Rule Undefined SPL
Cisco IOS XE Remote Access Probe Burst Undefined SPL
Cisco IOS XE VTY Access Class Tampering Undefined SPL
Cisco Network Interface Modifications Undefined SPL
Cisco Privileged Account Creation with HTTP Command Execution Undefined SPL
Cisco Privileged Account Creation with Suspicious SSH Activity Undefined SPL
Cisco Secure Firewall - Communication Over Suspicious Ports Undefined SPL
Cisco Secure Firewall - SSH Connection to Non-Standard Port Undefined SPL
Cisco Secure Firewall - SSH Connection to sshd_operns Undefined SPL

+ 54 more from splunk/security_content → showing the 10 highest-severity

Wazuh Core Ruleset

28 rules · 25 families
Detection Severity Format
Network activity using RDP port from-to loopback address, possible exploit using reverse tunneling Critical Wazuh XML
Powershell script used "Invoke-command" cmdlet to execute code on remote computer Critical Wazuh XML
User: \ logged using Remote Desktop Connection (RDP) from loopback address, possible exploit over reverse tunneling using stolen credentials. · win.eventdata.logonType = 10, win.eventdata.ipAddress = ::1|127\.0\.0\.1 Critical Wazuh XML
MS-FTP: Multiple FTP errors from same source. High Wazuh XML
New Windows Service Created to start from windows root path. Suspicious event as the binary may have been dropped using Windows Admin Shares. High Wazuh XML
A file was copied to other system over SSH using pscp.exe Medium Wazuh XML
A file was copied to this system over SSH using SCP. Medium Wazuh XML
sshd: insecure connection attempt (scan). Medium Wazuh XML
Successful Remote Logon Detected - User:\ - NTLM authentication, possible pass-the-hash attack - Possible RDP connection. Verify that is allowed to perform RDP connections · win.eventdata.workstationName = .+ Medium Wazuh XML
Amazon Security Lake - VPC - DCE/RPC connection established. 2 variants Low Wazuh XML

+ 18 more from Wazuh Core Ruleset → showing the 10 highest-severity

socfortress/Wazuh-Rules

25 rules · 23 families
Detection Severity Format
Powershell script: Lateral movement/recon cmdlet detected High Wazuh XML
Powershell script: TrustedHosts modification detected (DarkGate) High Wazuh XML
Sysmon - Event 1: Process creation · Change RDP Port via PowerShell (T1021.001) High Wazuh XML
Sysmon - Event 1: Process creation · Change RDP Port via reg.exe (T1021.001) High Wazuh XML
Sysmon - Event 1: Process creation · DCOM Spawned Process - calc.exe (T1021.003) High Wazuh XML
Sysmon - Event 1: Process creation · DCOM Spawned Process - foxprow.exe (T1021.003) High Wazuh XML
Sysmon - Event 1: Process creation · Disable NLA for RDP via Registry (T1021.001) High Wazuh XML
Sysmon - Event 1: Process creation · Open Firewall for Custom RDP Port via netsh (T1021.001) High Wazuh XML
Sysmon - Event 1: Process creation · Open Firewall for Custom RDP Port via PowerShell (T1021.001) High Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Excel DCOM Execution (T1021.003) High Wazuh XML

+ 15 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

elastic/protections-artifacts

23 rules
Detection Severity Format
Attempt to Mount a Remote WebDav Share Undefined Elastic TOML
Execution of a File Dropped from SMB Undefined Elastic TOML
Execution of a File Dropped from SMB via Services Undefined Elastic TOML
Execution via DCOM Excel Application Undefined Elastic TOML
ImageLoad of a File dropped via SMB Undefined Elastic TOML
Lateral Execution via DCOM Office Application Undefined Elastic TOML
Potential HackersChoice Tool Downloaded Undefined Elastic TOML
Potential Lateral Movement via SMBExec Undefined Elastic TOML
Potential Remote Execution via IMsiServer Undefined Elastic TOML
Powershell Execution via Named Pipe Undefined Elastic TOML

+ 13 more from elastic/protections-artifacts → showing the 10 highest-severity

panther-labs/panther-analysis

14 rules
Detection Severity Format
GitHub pull_request_target Workflow on Self-Hosted Runner High Panther Python
Kubernetes Role With Pod Exec Permissions Created High Panther Python
Kubernetes System Principal Accessed from Non-Cloud Public IP High Panther Python
MongoDB access allowed from anywhere High Panther Python
Wiz Issue WITH SSH to EC2 Instance High Panther Python
AWS Console GetSigninToken Potential Abuse Medium Panther Python
Databricks Access to Multiple Workspaces Medium Panther Python
Intune Create or Modify Client App Medium Panther Python
Intune New Device Management Script Medium Panther Python
OSQuery Detected SSH Listener Medium Panther Python

+ 4 more from panther-labs/panther-analysis → showing the 10 highest-severity

Azure/Azure-Sentinel

7 rules
Detection Severity Format
A host is potentially running a hacking tool (ASIM Web Session schema) Medium KQL
Rare RDP Connections Medium KQL
RDP Nesting Medium KQL
Multiple RDP connections from Single System Low KQL
BEC - File sharing tactics - Dropbox Undefined KQL
BEC - File sharing tactics - OneDrive or SharePoint Undefined KQL
Same User - Successful logon for a given App and failure on another App within 1m and low distribution Undefined KQL

chronicle/detection-rules

7 rules
Detection Severity Format
potential_remote_powershell_session_initiated High YARA-L
copy_from_or_to_admin_share_or_sysvol_folder Medium YARA-L
o365_persistent_login_activity_to_azure_ADPowerShell_app Medium YARA-L
mitre_attack_T1021_002_windows_admin_share_basic Low YARA-L
mitre_attack_T1021_002_windows_admin_share_with_asset_entity Low YARA-L
mitre_attack_T1021_002_windows_admin_share_with_user_enrichment Low YARA-L
mitre_attack_T1021_002_windows_admin_share_with_user_entity Low YARA-L

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
Detect SMB File Copies Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

Emerging Threats Open

1 rule
Detection Severity Format
ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement Medium Suricata

chainguard-dev/osquery-defense-kit

1 rule
Detection Severity Format
Find ssh sessions that are hiding from 'w'/'who' Undefined osquery SQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.