THREATNOIR
Subscribe
MITRE ATT&CK · T1021

Remote Services

MITRE · cited in 6 of our lessons

Explanation

What attackers do. Attackers use valid accounts to log into services that accept remote connections, such as remote desktop, SSH, SMB administrative shares, VNC or remote management, and move between systems. This serves the Lateral Movement tactic.

How to defend. Restrict remote access services to the hosts and users that need them, using firewalls and jump hosts. Require MFA for remote administration, disable unneeded services and use separate admin accounts. Collect authentication logs from endpoints and servers centrally. Use local administrator password randomisation so one compromised local password cannot open every host.

Signs to look for. Look for remote logins between workstations, admin accounts logging into many hosts quickly, connections from unusual sources and remote sessions outside working hours. A common gap is not collecting authentication logs from workstations.

Open the technique on MITRE ATT&CK
The official text
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.