1. Home
  2. ATT&CK Techniques
  3. T1133 External Remote Services

T1133 External Remote Services

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.(Citation: MacOS VNC software for Remote Desktop)

Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.

Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware)

Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool ShadowLink to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because ShadowLink sets up a .onion address on the compromised system. ShadowLink may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access.(Citation: The BadPilot campaign) Adversaries may get ShadowLink to persist on a system by masquerading it as an MS Defender application.(Citation: Russian threat actors dig in, prepare to seize on war fatigue)

View in MITRE ATT&CK®

CIS Controls Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work mitigates T1133 External Remote Services
Comments
Adversaries use externally accessible remote services to reach internal or privileged resources. Dedicated administrative systems are not externally reachable and accept access only through controlled administrative paths, directly preventing external remote-service access to the enclave.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls12/#128-establish-and-maintain-dedicated-computing-resources-for-all-administrative-work
CIS-12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure mitigates T1133 External Remote Services
Comments
Adversaries can use externally accessible remote-access services to enter enterprise networks. Requiring remote devices to authenticate through an enterprise-managed VPN and centralized AAA confines remote access to a controlled gateway, directly eliminating unmanaged direct access paths.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls12/#127-ensure-remote-devices-utilize-a-vpn-and-are-connecting-to-an-enterprises-aaa-infrastructure
CIS-12.2 Establish and Maintain a Secure Network Architecture mitigates T1133 External Remote Services
Comments
Adversaries use externally accessible VPNs, gateways, and remote-access services to enter enterprise networks. The architecture forces external access through designated controlled gateways while denying direct connectivity to internal resources, directly restricting unauthorized remote entry paths.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls12/#122-establish-and-maintain-a-secure-network-architecture
CIS-13.10 Perform Application Layer Filtering mitigates T1133 External Remote Services
Comments
Application-layer firewalls and proxies can restrict access to unauthorized remote-access services, anonymization services, and other external services used to access enterprise resources.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls13/#1310-perform-application-layer-filtering
CIS-13.5 Manage Access Control for Remote Access mitigates T1133 External Remote Services
Comments
Centrally managed authorization systems can restrict access to enterprise remote services based on the security posture of the connecting asset, including anti-malware status, secure-configuration compliance, and operating system or application update status.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls13/#135-manage-assets-remotely-connecting-to-enterprise-infrastructure
CIS-6.4 Require MFA for Remote Network Access mitigates T1133 External Remote Services
Comments
Enabling multi-factor authentication for external-facing remote service accounts to helps minimize the adversary's ability to leverage stolen credentials.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls6/#64-require-mfa-for-remote-network-access
CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software mitigates T1133 External Remote Services
Comments
Uninstalling or disabling unnecessary externally accessible VPN, remote desktop, SSH, and management services directly reduces external entry points.
References
    CIS-4.6 Securely Manage Enterprise Assets and Software mitigates T1133 External Remote Services
    Comments
    Requiring secure protocols and centrally managed administrative access reduces risk from externally accessible management services. Additional protections such as multi-factor authentication, gateways, and network restrictions remain necessary.
    References
      CIS-4.5 Implement and Manage a Firewall on End-User Devices mitigates T1133 External Remote Services
      Comments
      Host firewall map help when an external remote service terminates directly on the end-user device. Many VPN, VDI, and access-gateway implementations terminate on centralized infrastructure outside the endpoint firewall's control.
      References
        CIS-4.4 Implement and Manage a Firewall on Servers mitigates T1133 External Remote Services
        Comments
        A default-deny host firewall reduces the exposure of externally accessible remote services by permitting only explicitly authorized ports, protocols, and source systems.
        References
          CIS-16.8 Separate Production and Non-Production Systems mitigates T1133 External Remote Services
          Comments
          Production remote-access services can be exposed only through dedicated gateways, proxies, or approved access paths that are separate from non-production access, preventing direct remote connectivity from less-trusted environments into production.
          References
          1. https://cas.docs.cisecurity.org/en/latest/source/Controls16/#168-separate-production-and-non-production-systems

          VERIS Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1133 External Remote Services
          action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1133 External Remote Services
          action.hacking.vector.3rd party desktop 3rd party online desktop sharing (LogMeIn, Go2Assist) related-to T1133 External Remote Services
          action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1133 External Remote Services
          action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1133 External Remote Services
          action.hacking.vector.VPN VPN related-to T1133 External Remote Services
          action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1133 External Remote Services
          action.malware.vector.Remote injection Remotely injected by agent (i.e. via SQLi) related-to T1133 External Remote Services
          action.malware.vector.Web application Web application. Parent of 'Web application - download' and 'Web application - drive-by. related-to T1133 External Remote Services

          GCP Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          mandiant_asm Mandiant Attack Surface Management (ASM) technique_scores T1133 External Remote Services
          Comments
          Mandiant Attack Surface Management continuously discovers and assesses an organization's assets for vulnerabilities, misconfigurations, and exposures. This control can discover vulnerable Remote Services offered on the cloud or on hosted servers. Since this monitoring is continual and is derived from Mandiant cyber threat intelligence, this control is scored as significant.
          References
          1. https://cloud.google.com/security/products/attack-surface-management
          advanced_protection_program Advanced Protection Program technique_scores T1133 External Remote Services
          Comments
          Advanced Protection Program enables the use of a security key for multi-factor authentication. Enabling MFA for remote service accounts can mitigate an adversary's ability to leverage stolen credentials since they won't have the respective security key to gain access.
          References
          1. https://landing.google.com/advancedprotection/
          chrome_enterprise_premium Chrome Enterprise Premium technique_scores T1133 External Remote Services
          Comments
          Chrome Enterprise Premium implements a zero trust model which restricts access to resources unless all rules and conditions are met. Instead of securing resources at the network-level, access controls are instead applied to individual devices and users.
          References
          1. https://cloud.google.com/beyondcorp-enterprise/docs/overview
          cloud_identity Cloud Identity technique_scores T1133 External Remote Services
          Comments
          This control may mitigate an adversary's ability to leverage external-facing remote services through multi-factor authentication of service account credentials.
          References
          1. https://cloud.google.com/identity
          cloud_ngfw Cloud Next-Generation Firewall (NGFW)_ technique_scores T1133 External Remote Services
          Comments
          Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to only allow certain remote services to be available. Furthermore, it can enforce restrictions such that remote services are only from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because while it can limit which external remote services and hosts can be used to access the network, it cannot protect against the misuse of legitimate external remote services (e.g., it cannot protect against an adversary using a trusted host that is permitted to use remote services as part of an attack).
          References
          1. https://cloud.google.com/firewalls
          cloud_vpn Cloud VPN technique_scores T1133 External Remote Services
          Comments
          This control provides protections against adversaries who try to access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations.
          References
          1. https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview
          security_command_center Security Command Center technique_scores T1133 External Remote Services
          Comments
          SCC is able to detect attackers communicating with a compromised workload from a remote system (e.g., "reverse shell"). SCC specifically detects for stdin bound to a remote socket. Because of the high threat detection coverage and near-real time temporal factor this control was graded as significant.
          References
          1. https://cloud.google.com/security-command-center/docs/concepts-security-command-center-overview
          2. https://github.com/GoogleCloudPlatform/security-analytics

          AWS Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          amazon_inspector Amazon Inspector technique_scores T1133 External Remote Services
          Comments
          The Amazon Inspector Best Practices assessment package can detect a security control setting related to remote service access on Linux endpoints. Specifically, "Disable root login over SSH". This information can be used identify insecure configurations and harden the endpoints. Amazon Inspector does not directly protect against adversaries accessing remote services. Given Amazon Inspector can only assess this security control on Linux platforms (although it also supports Windows) and it only restricts access to remote services for one user account, the coverage score is Minimal leading to an overall Minimal score.
          References
          1. https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html
          aws_network_firewall AWS Network Firewall technique_scores T1133 External Remote Services
          Comments
          AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to only allow certain remote services to be available. Futhermore, it can enforce restrictions such that remote services are only from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because while it can limit which external remote services and hosts can be used to access the network, it cannot protect against the misuse of legitimate external remote services (e.g., it cannot protect against an adversary using a trusted host that is permitted to use remote services as part of an attack).
          References
          1. https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html
          amazon_virtual_private_cloud Amazon Virtual Private Cloud technique_scores T1133 External Remote Services
          Comments
          VPC security groups and network access control lists (NACLs) can limit access to external remote services to the minimum necessary.
          References
          1. https://docs.aws.amazon.com/vpc/latest/userguide/security.html
          aws_single_sign-on AWS Single Sign-On technique_scores T1133 External Remote Services
          Comments
          This control may protect against abuse of external remote services by requiring multi-factor authentication for single sign-on accounts.
          References
          1. https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html