External Remote Services

T1133

About this technique

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as a redundant or persistent access mechanism during an operation.

Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.

Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool `ShadowLink` to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because `ShadowLink` sets up a .onion address on the compromised system. `ShadowLink` may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access. Adversaries may get `ShadowLink` to persist on a system by masquerading it as an MS Defender application.

Detection rules56

Rules on DetectionCode tagged with T1133.

Sigma19

Rule	Level	Log source
External Remote SMB Logon from Public IP	high	windows / NULL
OpenCanary - RDP New Connection Attempt	high	opencanary / application
OpenCanary - SSH Login Attempt	high	opencanary / application
OpenCanary - SSH New Connection Attempt	high	opencanary / application
OpenCanary - Telnet Login Attempt	high	opencanary / application
Running Chrome VPN Extensions via the Registry 2 VPN Extension	high	windows / registry_set
Suspicious File Created by ArcSOC.exe	high	windows / file_event
Unusual Child Process of dns.exe	high	windows / process_creation
Unusual File Deletion by Dns.exe	high	windows / file_delete
Unusual File Modification by dns.exe	high	windows / file_change
User Added to Remote Desktop Users Group	high	windows / process_creation
External Remote RDP Logon from Public IP	medium	windows / NULL
Failed Logon From Public IP	medium	windows / NULL
FortiGate - New VPN SSL Web Portal Added	medium	fortigate / NULL
FortiGate - VPN SSL Settings Modified	medium	fortigate / NULL
Remote Access Tool - ScreenConnect Installation Execution	medium	windows / process_creation
Remote Access Tool - Team Viewer Session Started On Linux Host	low	linux / process_creation
Remote Access Tool - Team Viewer Session Started On MacOS Host	low	macos / process_creation
Remote Access Tool - Team Viewer Session Started On Windows Host	low	windows / process_creation

Splunk37

Rule	Type	Risk	Data source
Cisco Network Interface Modifications	Anomaly	NULL	Cisco IOS Logs
Confluence Unauthenticated Remote Code Execution CVE-2022-26134	TTP	NULL	Palo Alto Network Threat
Detect attackers scanning for vulnerable JBoss servers	TTP	NULL
Detect Exchange Web Shell	TTP	NULL	Sysmon EventID 11
Exchange PowerShell Abuse via SSRF	TTP	NULL
Exploit Public Facing Application via Apache Commons Text	Anomaly	NULL	Nginx Access
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952	TTP	NULL	Palo Alto Network Threat
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388	TTP	NULL	Palo Alto Network Threat
Fortinet Appliance Auth bypass	TTP	NULL	Palo Alto Network Threat
Hunting for Log4Shell	Hunting	NULL	Nginx Access
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078	TTP	NULL	Suricata
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082	TTP	NULL	Suricata
Java Writing JSP File	TTP	NULL	Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11
Linux Java Spawning Shell	TTP	NULL	Sysmon for Linux EventID 1
Living Off The Land Detection	Correlation	NULL
Log4Shell CVE-2021-44228 Exploitation	Correlation	NULL
Log4Shell JNDI Payload Injection Attempt	Anomaly	NULL	Nginx Access
Log4Shell JNDI Payload Injection with Outbound Connection	Anomaly	NULL	Splunk Stream IP
MS Exchange Mailbox Replication service writing Active Server Pages	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11
Outbound Network Connection from Java Using Default Ports	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 3
PaperCut NG Remote Web Access Attempt	TTP	NULL	Suricata
PaperCut NG Suspicious Behavior Debug Log	Hunting	NULL
ProxyShell ProxyNotShell Behavior Detected	Correlation	NULL
Spring4Shell Payload URL Request	TTP	NULL	Nginx Access
Supernova Webshell	TTP	NULL
VMWare Aria Operations Exploit Attempt	TTP	NULL	Palo Alto Network Threat
VMware Server Side Template Injection Hunt	Hunting	NULL	Palo Alto Network Threat
VMware Workspace ONE Freemarker Server-side Template Injection	Anomaly	NULL	Palo Alto Network Threat
Web JSP Request via URL	TTP	NULL	Nginx Access
Web or Application Server Spawning a Shell	TTP	NULL	Sysmon for Linux EventID 1, Sysmon EventID 1
Web Spring Cloud Function FunctionRouter	TTP	NULL	Splunk Stream HTTP
Web Spring4Shell HTTP Request Class Module	TTP	NULL	Splunk Stream HTTP
Windows Exchange Autodiscover SSRF Abuse	TTP	NULL	Windows IIS
Windows Java Spawning Shells	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows MOVEit Transfer Writing ASPX	TTP	NULL	Sysmon EventID 11
Windows PaperCut NG Spawn Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows RDPClient Connection Sequence Events	Anomaly	NULL	Windows Event Log Microsoft Windows TerminalServices RDPClient 1024

Software5

Doki Hildegard Kinsing Linux Rabbit Mafalda

Campaigns10

2015 Ukraine Electric Power Attack 2025 Poland Wiper Attacks ArcaneDoor C0027 C0032 CostaRicto Night Dragon Operation CuckooBees Operation Wocao SolarWinds Compromise

Procedure examples43

Groups28

Used by	Procedure example
GroupAkira	Akira uses compromised VPN accounts for initial access to victim networks. Secureworks GOLD SAHARA
GroupAPT-C-36	APT-C-36 has used VPNs in their operational infrastructure. Recorded Future TAG-144 AUG 2025
GroupAPT18	APT18 actors leverage legitimate credentials to log into external remote services. RSA2017 Detect and Respond Adair
GroupAPT28	APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts. Cybersecurity Advisory GRU Brute Force Campaign July 2021
GroupAPT29	APT29 has used compromised identities to access networks via VPNs and Citrix. Mandiant APT29 Microsoft 365 2022 NCSC APT29 July 2020
GroupAPT41	APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service. FireEye APT41 Aug 2019
GroupChimera	Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services. Cycraft Chimera April 2020 NCC Group Chimera January 2021
GroupDragonfly	Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks. CISA AA20-296A Berserk Bear December 2020 US-CERT TA18-074A

View all 28 groups examples

Software5

Used by	Procedure example
MalwareDoki	Doki was executed through an open Docker daemon API port. Intezer Doki July 20
MalwareHildegard	Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment. Unit 42 Hildegard Malware
MalwareKinsing	Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API. Aqua Kinsing April 2020
MalwareLinux Rabbit	Linux Rabbit attempts to gain access to the server via SSH. Anomali Linux Rabbit 2018
MalwareMafalda	Mafalda can establish an SSH connection from a compromised host to a server. SentinelLabs Metador Technical Appendix Sept 2022

Campaigns10

Used by	Procedure example
Campaign2015 Ukraine Electric Power Attack	During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a modified Dropbear SSH client as the backdoor to target systems. Booz Allen Hamilton
Campaign2025 Poland Wiper Attacks	During the 2025 Poland Wiper Attacks, threat actors leveraged the FortiGate VPN interface that was exposed to the internet to gain access to the victim environment. CERT Polska Dragos ELECTRUM JAN 2026
CampaignArcaneDoor	ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices. CCCS ArcaneDoor 2024
CampaignC0027	During C0027, Scattered Spider used Citrix and VPNs to persist in compromised environments. Crowdstrike TELCO BPO Campaign December 2022
CampaignC0032	During the C0032 campaign, TEMP.Veles used VPN access to persist in the victim environment. FireEye TRITON 2019
CampaignCostaRicto	During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment. BlackBerry CostaRicto November 2020
CampaignNight Dragon	During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems. McAfee Night Dragon
CampaignOperation CuckooBees	During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`. Cybereason OperationCuckooBees May 2022

View all 10 campaigns examples

References6

MacOS VNC software for Remote Desktop Open source
Apple Support. (n.d.). Set up a computer running VNC software for Remote Desktop. Retrieved August 18, 2021.
Russian threat actors dig in, prepare to seize on war fatigue Open source
Microsoft Threat Intelligence. (2023, December 7). Russian threat actors dig in, prepare to seize on war fatigue. Retrieved June 18, 2025.
The BadPilot campaign Open source
Microsoft Threat Intelligence. (2025, February 12). The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation. Retrieved June 18, 2025.
Trend Micro Exposed Docker Server Open source
Remillano II, A., et al. (2020, June 20). XORDDoS, Kaiji Variants Target Exposed Docker Servers. Retrieved April 5, 2021.
Unit 42 Hildegard Malware Open source
Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.
Volexity Virtual Private Keylogging Open source
Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.