T1021 Remote Services | DetectionCode

About this technique

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter.

Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.

Detection rules155

Rules on DetectionCode tagged with T1021 or one of its sub-techniques.

Sigma88

Rule	Level	Log source	Technique
CobaltStrike Service Installations - System	critical	windows / NULL	T1021.002
Potential DCOM InternetExplorer.Application DLL Hijack	critical	windows / file_event	T1021.002 T1021.003
Potential DCOM InternetExplorer.Application DLL Hijack - Image Load	critical	windows / image_load	T1021.002 T1021.003
Wmiprvse Wbemcomn DLL Hijack - File	critical	windows / file_event	T1021.002
BaaUpdate.exe Suspicious DLL Load	high	windows / image_load	T1021.003
CobaltStrike Service Installations - Security	high	windows / NULL	T1021.002
DCOM InternetExplorer.Application Iertutil DLL Hijack - Security	high	windows / NULL	T1021.002 T1021.003
First Time Seen Remote Named Pipe	high	windows / NULL	T1021.002
First Time Seen Remote Named Pipe - Zeek	high	zeek / NULL	T1021.002
HackTool - NetExec Execution	high	windows / process_creation	T1021
HackTool - NetExec File Indicators	high	windows / file_event	T1021.002
HackTool - Potential Impacket Lateral Movement Activity	high	windows / process_creation	T1021.003
HackTool - SharpMove Tool Execution	high	windows / process_creation	T1021.002
Impacket PsExec Execution	high	windows / NULL	T1021.002
Metasploit Or Impacket Service Installation Via SMB PsExec	high	windows / NULL	T1021.002
Metasploit SMB Authentication	high	windows / NULL	T1021.002
MMC Spawning Windows Shell	high	windows / process_creation	T1021.003
MMC20 Lateral Movement	high	windows / process_creation	T1021.003
OMIGOD HTTP No Authentication RCE	high	zeek / NULL	T1021.006
OpenCanary - FTP Login Attempt	high	opencanary / application	T1021
OpenCanary - RDP New Connection Attempt	high	opencanary / application	T1021.001
OpenCanary - SMB File Open Request	high	opencanary / application	T1021
OpenCanary - SNMP OID Request	high	opencanary / application	T1021
OpenCanary - SSH Login Attempt	high	opencanary / application	T1021
OpenCanary - SSH New Connection Attempt	high	opencanary / application	T1021
OpenCanary - VNC Connection Attempt	high	opencanary / application	T1021
Outbound RDP Connections Over Non-Standard Tools	high	windows / network_connection	T1021.001
Potential CobaltStrike Service Installations - Registry	high	windows / registry_set	T1021.002
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp	high	windows / process_creation	T1021.003
Potential Remote PowerShell Session Initiated	high	windows / network_connection	T1021.006
Potential Tampering With RDP Related Registry Keys Via Reg.EXE	high	windows / process_creation	T1021.001
Privilege Escalation via Named Pipe Impersonation	high	windows / process_creation	T1021
Protected Storage Service Access	high	windows / NULL	T1021.002
Publicly Accessible RDP Service	high	zeek / NULL	T1021.001
RDP Login from Localhost	high	windows / NULL	T1021.001
RDP Over Reverse SSH Tunnel	high	windows / network_connection	T1021.001
RDP over Reverse SSH Tunnel WFP	high	windows / NULL	T1021.001
RDP to HTTP or HTTPS Target Ports	high	windows / network_connection	T1021.001
Remote DCOM/WMI Lateral Movement	high	rpc_firewall / application	T1021.003
Remote LSASS Process Access Through Windows Remote Management	high	windows / process_access	T1021.006
Remote PowerShell Session (PS Module)	high	windows / ps_module	T1021.006
Rundll32 Execution Without Parameters	high	windows / process_creation	T1021.002
Rundll32 UNC Path Execution	high	windows / process_creation	T1021.002
SMB Create Remote File Admin Share	high	windows / NULL	T1021.002
smbexec.py Service Installation	high	windows / NULL	T1021.002
Suspicious BitLocker Access Agent Update Utility Execution	high	windows / process_creation	T1021.003
Suspicious Plink Port Forwarding	high	windows / process_creation	T1021.001
Suspicious PsExec Execution	high	windows / NULL	T1021.002
Suspicious PsExec Execution - Zeek	high	zeek / NULL	T1021.002
Suspicious RDP Redirect Using TSCON	high	windows / process_creation	T1021.001
Suspicious Speech Runtime Binary Child Process	high	windows / process_creation	T1021.003
Suspicious UltraVNC Execution	high	windows / process_creation	T1021.005
T1047 Wmiprvse Wbemcomn DLL Hijack	high	windows / NULL	T1021.002
User Added to Remote Desktop Users Group	high	windows / process_creation	T1021.001
Windows Internet Hosted WebDav Share Mount Via Net.EXE	high	windows / process_creation	T1021.002
Winrs Local Command Execution	high	windows / process_creation	T1021.006
Wmiprvse Wbemcomn DLL Hijack	high	windows / image_load	T1021.002
AWS Console GetSigninToken Potential Abuse	medium	aws / NULL	T1021.007
Bitbucket Global SSH Settings Changed	medium	bitbucket / NULL	T1021.004
Bitbucket User Login Failure Via SSH	medium	bitbucket / NULL	T1021.004
Copy From Or To Admin Share Or Sysvol Folder	medium	windows / process_creation	T1021.002
DCERPC SMB Spoolss Named Pipe	medium	windows / NULL	T1021.002
Denied Access To Remote Desktop	medium	windows / NULL	T1021.001
Enable Windows Remote Management	medium	windows / ps_script	T1021.006
Execute Invoke-command on Remote Host	medium	windows / ps_script	T1021.006
HackTool - WinRM Access Via Evil-WinRM	medium	windows / process_creation	T1021.006
New Remote Desktop Connection Initiated Via Mstsc.EXE	medium	windows / process_creation	T1021.001
OpenEDR Spawning Command Shell	medium	windows / process_creation	T1021.004
OpenSSH Server Listening On Socket	medium	windows / NULL	T1021.004
Password Provided In Command Line Of Net.EXE	medium	windows / process_creation	T1021.002
Port Forwarding Activity Via SSH.EXE	medium	windows / process_creation	T1021.001 T1021.004
Potential Lateral Movement via Windows Remote Shell	medium	windows / process_creation	T1021.006
Potential Remote Desktop Tunneling	medium	windows / process_creation	T1021
Psexec Execution	medium	windows / process_creation	T1021
PUA - CSExec Default Named Pipe	medium	windows / pipe_created	T1021.002
PUA - RemCom Default Named Pipe	medium	windows / pipe_created	T1021.002
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class	medium	windows / process_creation	T1021.001
Remote PowerShell Session Host Process (WinRM)	medium	windows / process_creation	T1021.006
Remote Service Activity via SVCCTL Named Pipe	medium	windows / NULL	T1021.002
SMB Spoolss Name Piped Usage	medium	zeek / NULL	T1021.002
Suspicious New-PSDrive to Admin Share	medium	windows / ps_script	T1021.002
Suspicious Non PowerShell WSMAN COM Provider	medium	windows / NULL	T1021.003
Suspicious WSMAN Provider Image Loads	medium	windows / image_load	T1021.003
Unsigned or Unencrypted SMB Connection to Share Established	medium	windows / NULL	T1021.002
Windows Admin Share Mount Via Net.EXE	medium	windows / process_creation	T1021.002
Access To ADMIN$ Network Share	low	windows / NULL	T1021.002
Remote PowerShell Session (PS Classic)	low	windows / ps_classic_start	T1021.006
Windows Share Mount Via Net.EXE	low	windows / process_creation	T1021.002

Splunk67

Rule	Type	Risk	Data source	Technique
Allow Inbound Traffic By Firewall Rule Registry	TTP	NULL	Sysmon EventID 13	T1021.001
Allow Inbound Traffic In Firewall Rule	TTP	NULL	Powershell Script Block Logging 4104	T1021.001
Cisco IOS XE Remote Access Probe Burst	Anomaly	NULL	Cisco IOS Logs	T1021.004
Cisco IOS XE VTY Access Class Tampering	Anomaly	NULL	Cisco IOS Logs	T1021
Cisco Network Interface Modifications	Anomaly	NULL	Cisco IOS Logs	T1021
Cisco Privileged Account Creation with HTTP Command Execution	Correlation	NULL		T1021.004
Cisco Privileged Account Creation with Suspicious SSH Activity	Correlation	NULL		T1021.004
Cisco Secure Firewall - Communication Over Suspicious Ports	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1021
Cisco Secure Firewall - SSH Connection to Non-Standard Port	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1021.004
Cisco Secure Firewall - SSH Connection to sshd_operns	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1021.004
Detect PsExec With accepteula Flag	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.002
Enable RDP In Other Port Number	TTP	NULL	Sysmon EventID 13	T1021
ESXi Shell Access Enabled	TTP	NULL	VMWare ESXi Syslog	T1021
ESXi SSH Enabled	TTP	NULL	VMWare ESXi Syslog	T1021.004
Executable File Written in Administrative SMB Share	TTP	NULL	Windows Event Log Security 5145	T1021.002
Impacket Lateral Movement Commandline Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.002 T1021.003
Impacket Lateral Movement smbexec CommandLine Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.002 T1021.003
Impacket Lateral Movement WMIExec Commandline Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.002 T1021.003
Interactive Session on Remote Endpoint with PowerShell	TTP	NULL	Powershell Script Block Logging 4104	T1021.006
Linux SSH Remote Services Script Execute	TTP	NULL	Sysmon for Linux EventID 1	T1021.004
Microsoft Intune Device Health Scripts	Hunting	NULL	Azure Monitor Activity	T1021.007
Microsoft Intune DeviceManagementConfigurationPolicies	Hunting	NULL	Azure Monitor Activity	T1021.007
Microsoft Intune Manual Device Management	Hunting	NULL	Azure Monitor Activity	T1021.007
Microsoft Intune Mobile Apps	Hunting	NULL	Azure Monitor Activity	T1021.007
Mmc LOLBAS Execution Process Spawn	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.003
Possible Lateral Movement PowerShell Spawn	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.003 T1021.006
Powershell Remote Services Add TrustedHost	TTP	NULL	Powershell Script Block Logging 4104	T1021.006
Remote Desktop Network Traffic	Anomaly	NULL	Zeek Conn	T1021.001
Remote Desktop Process Running On System	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.001
Remote Process Instantiation via DCOM and PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.003
Remote Process Instantiation via DCOM and PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104	T1021.003
Remote Process Instantiation via WinRM and PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.006
Remote Process Instantiation via WinRM and PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104	T1021.006
Remote Process Instantiation via WinRM and Winrs	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.006
SMB Traffic Spike	Anomaly	NULL		T1021.002
SMB Traffic Spike - MLTK	Anomaly	NULL		T1021.002
Windows Alternate Data Stream Created Over Local Share	Anomaly	NULL	Windows Event Log Security 5145	T1021.002
Windows Azure PowerShell Module Installation Via PowerShell Script	Anomaly	NULL	Powershell Script Block Logging 4104	T1021.007
Windows Default RDP File Creation	Anomaly	NULL	Sysmon EventID 11	T1021.001
Windows Default RDP File Creation By Non MSTSC Process	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1021.001
Windows Default Rdp File Unhidden	Anomaly	NULL	Sysmon EventID 1	T1021.001
Windows Excel ActiveMicrosoftApp Child Process	Anomaly	NULL	Sysmon EventID 1	T1021.003
Windows Excel Spawning Microsoft Project Application	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.003
Windows MSTSC RDP Commandline	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.001
Windows Process Execution From RDP Share	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.001
Windows Protocol Tunneling with Plink	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.004
Windows PUA Named Pipe	Anomaly	NULL	Sysmon EventID 17, Sysmon EventID 18	T1021.002
Windows PuTTY Suite Utility Execution	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.004
Windows RDP Bitmap Cache File Creation	Anomaly	NULL	Sysmon EventID 11	T1021.001
Windows RDP Client Launched with Admin Session	Anomaly	NULL	Sysmon EventID 1	T1021.001
Windows RDP File Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.001
Windows RDP Login Session Was Established	Anomaly	NULL	Windows Event Log Security 4624	T1021.001
Windows RDP Server Registry Entry Created	Anomaly	NULL	Sysmon EventID 13	T1021.001
Windows Remote Host Computer Management Access	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1021.006
Windows Remote Management Execute Shell	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1021.006
Windows Remote Service Rdpwinst Tool Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.001
Windows Remote Services Allow Rdp In Firewall	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.001
Windows Remote Services Allow Remote Assistance	Anomaly	NULL	Sysmon EventID 13	T1021.001
Windows Remote Services Rdp Enable	TTP	NULL	Sysmon EventID 13	T1021.001
Windows RMM Named Pipe	Anomaly	NULL	Sysmon EventID 17, Sysmon EventID 18	T1021.002
Windows Special Privileged Logon On Multiple Hosts	TTP	NULL	Windows Event Log Security 4672	T1021.002
Windows SpeechRuntime COM Hijacking DLL Load	TTP	NULL	Sysmon EventID 7	T1021.003
Windows SpeechRuntime Suspicious Child Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.003
Windows Suspicious C2 Named Pipe	TTP	NULL	Sysmon EventID 17, Sysmon EventID 18	T1021.002
Windows Suspicious Named Pipe	TTP	NULL	Sysmon EventID 17, Sysmon EventID 18	T1021.002
Windows Theme File Creation in Unusual Location	Anomaly	NULL	Sysmon EventID 11	T1021.002
Wsmprovhost LOLBAS Execution Process Spawn	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1021.006

Sub-techniques8

ID	Name	Examples
T1021.001	Remote Desktop Protocol	63
T1021.002	SMB/Windows Admin Shares	65
T1021.003	Distributed Component Object Model	3
T1021.004	SSH	27
T1021.005	VNC	11
T1021.006	Windows Remote Management	10
T1021.007	Cloud Services	5
T1021.008	Direct Cloud VM Connections	0

Groups3

Software4

Brute Ratel C4 Kivars MacMa Stuxnet

Campaigns0

None recorded.

Procedure examples7

Groups3

Used by	Procedure example
GroupAquatic Panda	Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions. Crowdstrike HuntReport 2022
GroupEmber Bear	Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so. Cadet Blizzard emerges as novel threat actor
GroupWizard Spider	Wizard Spider has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares. Mandiant FIN12 Oct 2021

Software4

Used by	Procedure example
ToolBrute Ratel C4	Brute Ratel C4 has the ability to use RPC for lateral movement. Palo Alto Brute Ratel July 2022
MalwareKivars	Kivars has the ability to remotely trigger keyboard input and mouse clicks. TrendMicro BlackTech June 2017
MalwareMacMa	MacMa can manage remote screen sessions. ESET DazzleSpy Jan 2022
MalwareStuxnet	Stuxnet can propagate via peer-to-peer communication and updates using RPC. Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

References7

Apple Remote Desktop Admin Guide 3.3 Open source
Apple. (n.d.). Apple Remote Desktop Administrator Guide Version 3.3. Retrieved October 5, 2021.
FireEye 2019 Apple Remote Desktop Open source
Jake Nicastro, Willi Ballenthin. (2019, October 9). Living off the Orchard: Leveraging Apple Remote Desktop for Good and Evil. Retrieved August 16, 2021.
Kickstart Apple Remote Desktop commands Open source
Apple. (n.d.). Use the kickstart command-line utility in Apple Remote Desktop. Retrieved September 23, 2021.
Lockboxx ARD 2019 Open source
Dan Borges. (2019, July 21). MacOS Red Teaming 206: ARD (Apple Remote Desktop Protocol). Retrieved September 10, 2021.
Remote Management MDM macOS Open source
Apple. (n.d.). Use MDM to enable Remote Management in macOS. Retrieved September 23, 2021.
SSH Secure Shell Open source
SSH.COM. (n.d.). SSH (Secure Shell). Retrieved March 23, 2020.
TechNet Remote Desktop Services Open source
Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1, 2016.