[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1021":3},{"item":4,"lessons":18,"controls":44,"related":72},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1021","T1021","Remote Services",6,"MITRE","**What attackers do.** Attackers use valid accounts to log into services that accept remote connections, such as remote desktop, SSH, SMB administrative shares, VNC or remote management, and move between systems. This serves the Lateral Movement tactic.\n\n**How to defend.** Restrict remote access services to the hosts and users that need them, using firewalls and jump hosts. Require MFA for remote administration, disable unneeded services and use separate admin accounts. Collect authentication logs from endpoints and servers centrally. Use local administrator password randomisation so one compromised local password cannot open every host.\n\n**Signs to look for.** Look for remote logins between workstations, admin accounts logging into many hosts quickly, connections from unusual sources and remote sessions outside working hours. A common gap is not collecting authentication logs from workstations.","Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.\n\nIn an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. \n\nLegitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1021\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"multi-group-campaign-exploits-unpatched-exchange-servers-and-stolen-credentials-to-deploy-backdoors-","Multi-Group Campaign Exploits Unpatched Exchange Servers and Stolen Credentials to Deploy Backdoors and Ransomware","2026-09-16T18:21:42.971+00:00",{"slug":25,"title":26,"published_at":27},"hijacked-screenconnect-instances-spread-worm-like-malware-across-networks","Hijacked ScreenConnect Instances Spread Worm-Like Malware Across Networks","2026-09-03T19:20:59.39+00:00",{"slug":29,"title":30,"published_at":31},"windows-named-pipes-weak-access-controls-open-door-to-privilege-abuse","Windows Named Pipes: Weak Access Controls Open Door to Privilege Abuse","2026-08-22T14:20:17.653+00:00",{"slug":33,"title":34,"published_at":35},"twinloot-exploits-trusted-microsoft-services-for-stealthy-credential-theft","TWINLOOT Exploits Trusted Microsoft Services for Stealthy Credential Theft","2026-08-18T14:21:30.404+00:00",{"slug":37,"title":38,"published_at":39},"ai-agents-exploit-artifactory-flaw-escape-to-internet-via-hugging-face","AI Agents Exploit Artifactory Flaw, Escape to Internet via Hugging Face","2026-08-15T04:20:24.016+00:00",{"slug":41,"title":42,"published_at":43},"autonomous-ai-agent-exploits-code-execution-flaw-to-breach-hugging-face","Autonomous AI Agent Exploits Code-Execution Flaw to Breach Hugging Face","2026-07-20T10:20:25.585+00:00",[45,50,55,59,63,68],{"slug":46,"name":47,"problem":48,"stories":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":51,"name":52,"problem":53,"stories":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",2,{"slug":56,"name":57,"problem":58,"stories":54},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":60,"name":61,"problem":62,"stories":54},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":64,"name":65,"problem":66,"stories":67},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,{"slug":69,"name":70,"problem":71,"stories":67},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[73,78,84,88,93,97,101,105],{"family":74,"item":75,"code":76,"title":77,"together":49},"nist-800-53","sc-7","SC-7","Boundary Protection",{"family":79,"item":80,"code":81,"title":82,"together":83},"cis","12","Control 12","Network Infrastructure Management",4,{"family":79,"item":85,"code":86,"title":87,"together":83},"13","Control 13","Network Monitoring and Defense",{"family":74,"item":89,"code":90,"title":91,"together":92},"si-3","SI-3","Malicious Code Protection",3,{"family":79,"item":94,"code":95,"title":96,"together":92},"16","Control 16","Application Software Security",{"family":79,"item":98,"code":99,"title":100,"together":92},"7","Control 7","Continuous Vulnerability Management",{"family":74,"item":102,"code":103,"title":104,"together":92},"ac-6","AC-6","Least Privilege",{"family":106,"item":107,"code":108,"title":109,"together":92},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring"]