1. Home
  2. ATT&CK Techniques
  3. T1021 Remote Services

T1021 Remote Services

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter.

Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation: Kickstart Apple Remote Desktop commands)

View in MITRE ATT&CK®

CIS Controls Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CIS-13.5 Manage Access Control for Remote Access mitigates T1021 Remote Services
Comments
Centrally managed remote-access controls can restrict access to enterprise remote services so remote assets are permitted access only when they satisfy enterprise device-security and configuration requirements.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls13/#135-manage-assets-remotely-connecting-to-enterprise-infrastructure
CIS-6.8 Define and Maintain Role-Based Access Control mitigates T1021 Remote Services
Comments
Using role-based access control (RBAC) to limit which accounts can use remote services and restrict the commands or resources available to those accounts to help prevent adversaries from using remote services for lateral movement.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls6/#68-define-and-maintain-role-based-access-control
CIS-6.4 Require MFA for Remote Network Access mitigates T1021 Remote Services
Comments
Enabling multi-factor authentication for remote service logons helps minimize the adversary's ability to leverage stolen credentials.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls6/#64-require-mfa-for-remote-network-access
CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software mitigates T1021 Remote Services
Comments
Disabling unnecessary remote services eliminates the corresponding authentication and remote-access path, directly reducing lateral movement opportunities.
References
    CIS-4.6 Securely Manage Enterprise Assets and Software mitigates T1021 Remote Services
    Comments
    Securely managing which remote services are permitted and requiring authenticated encrypted protocols reduces exposed administrative paths. The safeguard does not independently prevent adversaries from using valid credentials through an approved service.
    References
      CIS-4.5 Implement and Manage a Firewall on End-User Devices mitigates T1021 Remote Services
      Comments
      A default-deny endpoint firewall directly restricts unsolicited remote-service connections and permits access only through explicitly approved services, ports, and management paths.
      References
        CIS-4.4 Implement and Manage a Firewall on Servers mitigates T1021 Remote Services
        Comments
        A default-deny host firewall directly restricts inbound remote service access to servers, reducing opportunities for remote administration and lateral movement.
        References
          CIS-3.12 Segment Data Processing and Storage Based on Sensitivity mitigates T1021 Remote Services
          Comments
          Segmentation directly limits attacker movement between remote-accessible systems and sensitive environments.
          References
          1. https://cas.docs.cisecurity.org/en/latest/source/Controls3/

          VERIS Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021 Remote Services
          action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1021 Remote Services
          action.malware.vector.Network propagation Network propagation related-to T1021 Remote Services

          GCP Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          mandiant_asm Mandiant Attack Surface Management (ASM) technique_scores T1021 Remote Services
          Comments
          Mandiant Attack Surface Management continuously discovers and assesses an organization's assets for vulnerabilities, misconfigurations, and exposures. This control can discover vulnerable Remote Services offered on the cloud or on hosted servers. Since this monitoring is continual and is derived from Mandiant cyber threat intelligence, this control is scored as significant.
          References
          1. https://cloud.google.com/security/products/attack-surface-management
          advanced_protection_program Advanced Protection Program technique_scores T1021 Remote Services
          Comments
          Advanced Protection Program enables the use of a security key for multi-factor authentication. Implementing MFA on remote service logons prevents adversaries from using valid accounts to access those services.
          References
          1. https://cloud.google.com/security/products/security-operations
          2. https://cloud.google.com/chronicle/docs/secops/secops-overview
          3. https://github.com/chronicle/detection-rules
          cloud_ngfw Cloud Next-Generation Firewall (NGFW)_ technique_scores T1021 Remote Services
          Comments
          Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to only allow remote services from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because even though it can restrict remote services traffic from untrusted hosts for most of the sub-techniques (5 of 6), it cannot protect against an adversary using a trusted host that is permitted to use remote services as part of an attack.
          References
          1. https://cloud.google.com/firewalls
          google_secops Google Security Operations technique_scores T1021 Remote Services
          Comments
          Google Security Ops is able to detect an alert based on system events, such as remote service connections. This mapping was scored as minimal based on low or uncertain detection coverage factor of this technique. https://github.com/chronicle/detection-rules/tree/main/soc_prime_rules/threat_hunting/windows
          References
          1. https://cloud.google.com/security/products/security-operations
          2. https://cloud.google.com/chronicle/docs/secops/secops-overview
          3. https://github.com/chronicle/detection-rules

          AWS Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          amazon_inspector Amazon Inspector technique_scores T1021 Remote Services
          Comments
          The Amazon Inspector Best Practices assessment package can detect a security control setting related to remote service access on Linux endpoints. Specifically, "Disable root login over SSH". This information can be used identify insecure configurations and harden the endpoints. Amazon Inspector does not directly protect against adversaries accessing remote services. Given Amazon Inspector can only assess this security control on Linux platforms (although it also supports Windows), it only restricts access to remote services for one user account, and only supports one sub-technique, the coverage score is Minimal leading to an overall Minimal score.
          References
          1. https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html
          aws_network_firewall AWS Network Firewall technique_scores T1021 Remote Services
          Comments
          AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to only allow remote services from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because even though it can restrict remote services traffic from untrusted hosts for most of the sub-techniques (5 of 6), it cannot protect against an adversary using a trusted host that is permitted to use remote services as part of an attack.
          References
          1. https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html
          amazon_virtual_private_cloud Amazon Virtual Private Cloud technique_scores T1021 Remote Services
          Comments
          VPC security groups and network access control lists (NACLs) can provide partial protection for all of its sub-techniques and procedure examples resulting in an overall score of Partial.
          References
          1. https://docs.aws.amazon.com/vpc/latest/userguide/security.html

          ATT&CK Subtechniques

          Technique ID Technique Name Number of Mappings
          T1021.005 VNC 8
          T1021.004 SSH 12
          T1021.008 Direct Cloud VM Connections 9
          T1021.002 SMB/Windows Admin Shares 10
          T1021.006 Windows Remote Management 12
          T1021.003 Distributed Component Object Model 9
          T1021.007 Cloud Services 9
          T1021.001 Remote Desktop Protocol 13