Cross-source coverage
T1133 / ATT&CK
External Remote Services
108 rules · 107 families across 7 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as a redundant or persistent access mechanism during an operation.
Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.
Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool ShadowLink to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because ShadowLink sets up a.onion address on the compromised system. ShadowLink may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access. Adversaries may get ShadowLink to persist on a system by masquerading it as an MS Defender application.
- Tactics
- Persistence · Initial Access
- Platforms
- Containers · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:ApplicationWinEventLog:Sysmonauditd:SYSCALLNSM:ConnectionsNSM:Flowmacos:unifiedlogPF:LogsApplicationLog:APIkubernetes:audit
How MITRE says to detect it DET0354
Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
Windows Analytic 1004
Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.
WinEventLog:SecurityEventCode=4776, 4625WinEventLog:ApplicationVPN, Citrix, or remote access gateway logs showing external IP addressesWinEventLog:SysmonEventCode=3, 22
Linux Analytic 1005
Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).
auditd:SYSCALLssh logins or execve of remote commandsNSM:ConnectionsFailed password or accepted password for SSH usersNSM:Flowconnection: Inbound connections to SSH or VPN ports
macOS Analytic 1006
Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.
macos:unifiedlogRemote login (ssh) or screen sharing authentication attemptsmacos:unifiedlogInbound connections to VNC/SSH portsPF:LogsExternal traffic to remote access services
Containers Analytic 1007
Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.
ApplicationLog:APIDocker/Kubernetes API access from external sourceskubernetes:auditUnauthorized container creation or kubelet exec logsNSM:FlowExternal access to container ports (2375, 6443)
splunk/security_content
35 rules| Detection | Severity | Format |
|---|---|---|
| Cisco Network Interface Modifications | Undefined | SPL |
| Confluence Unauthenticated Remote Code Execution CVE-2022-26134 | Undefined | SPL |
| Detect attackers scanning for vulnerable JBoss servers | Undefined | SPL |
| Detect Exchange Web Shell | Undefined | SPL |
| Exchange PowerShell Abuse via SSRF | Undefined | SPL |
| Exploit Public Facing Application via Apache Commons Text | Undefined | SPL |
| Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 | Undefined | SPL |
| F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 | Undefined | SPL |
| Fortinet Appliance Auth bypass | Undefined | SPL |
| Hunting for Log4Shell | Undefined | SPL |
+ 25 more from splunk/security_content → showing the 10 highest-severity
elastic/detection-rules
26 rules| Detection | Severity | Format |
|---|---|---|
| AWS Lambda Function URL Created with Public Access | High | Elastic TOML |
| Deprecated - SSH Connection Established Inside A Running Container | High | Elastic TOML |
| Deprecated - SSH Process Launched From Inside A Container | High | Elastic TOML |
| Multiple SonicWall Login Failures Followed by Successful Login | High | Elastic TOML |
| RPC (Remote Procedure Call) from the Internet | High | Elastic TOML |
| SMB (Windows File Sharing) Activity from the Internet | High | Elastic TOML |
| VNC (Virtual Network Computing) from the Internet | High | Elastic TOML |
| Accepted Default Telnet Port Connection | Medium | Elastic TOML |
| AWS RDS DB Instance Made Public | Medium | Elastic TOML |
| Deprecated - SSH Process Launched From Inside A Container via Elastic Defend | Medium | Elastic TOML |
+ 16 more from elastic/detection-rules → showing the 10 highest-severity
Wazuh Core Ruleset
23 rules · 22 families| Detection | Severity | Format |
|---|---|---|
| ASA: Multiple AAA (VPN) authentication failures. | High | Wazuh XML |
| Asterisk: Extension enumeration. | High | Wazuh XML |
| Asterisk: Extension IAX Enumeration. | High | Wazuh XML |
| Asterisk: Multiple failed logins. 2 variants | High | Wazuh XML |
| Asterisk: Multiple failed logins. 2 variants | High | Wazuh XML |
| Asterisk: Multiple failed logins (user enumeration in process). | High | Wazuh XML |
| CiscoVPN: Multiple VPN authentication failures. | High | Wazuh XML |
| Netscaler: Multiple http resource access denied | High | Wazuh XML |
| Netscaler: Multiple non-http resource access denied | High | Wazuh XML |
| PIX: Multiple AAA (VPN) authentication failures. | High | Wazuh XML |
+ 13 more from Wazuh Core Ruleset → showing the 10 highest-severity
SigmaHQ/sigma
20 rules| Detection | Severity | Format |
|---|---|---|
| External Remote SMB Logon from Public IP | High | Sigma |
| OpenCanary - RDP New Connection Attempt | High | Sigma |
| OpenCanary - SSH Login Attempt | High | Sigma |
| OpenCanary - SSH New Connection Attempt | High | Sigma |
| OpenCanary - Telnet Login Attempt | High | Sigma |
| Potential Exploitation of GoAnywhere MFT Vulnerability | High | Sigma |
| Running Chrome VPN Extensions via the Registry 2 VPN Extension | High | Sigma |
| Suspicious File Created by ArcSOC.exe | High | Sigma |
| Unusual Child Process of dns.exe | High | Sigma |
| Unusual File Deletion by Dns.exe | High | Sigma |
+ 10 more from SigmaHQ/sigma → showing the 10 highest-severity
panther-labs/panther-analysis
2 rules| Detection | Severity | Format |
|---|---|---|
| AWS RDS Instance Modified to be Publicly Accessible | Critical | Panther Python |
| Wiz Issue WITH SSH to EC2 Instance | High | Panther Python |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| Potential SSH Tunnel to AAD Connect Host | Undefined | KQL |