THREATNOIR
Subscribe
MITRE ATT&CK · T1210

Exploitation of Remote Services

MITRE · cited in 7 of our lessons

Explanation

What attackers do. Attackers exploit vulnerabilities in internal network services, such as file sharing, remote desktop or database services, to gain access to other systems after they are already inside. This serves the Lateral Movement tactic.

How to defend. Patch internal systems as well as internet-facing ones, segment networks so that workstations cannot reach server management services, and disable unneeded services and legacy protocols. Network detection and intrusion prevention systems can catch exploitation of known vulnerabilities. Prioritise patches for internal services with known exploits, as these are favoured by ransomware groups.

Signs to look for. Look for exploit signatures in internal network traffic, services crashing and restarting, and new processes started by network services. A common gap is assuming internal services are safe because they are not exposed to the internet.

Open the technique on MITRE ATT&CK
The official text
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system. An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Discovery or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources. There are several well-known vulnerabilities that exist in common services such as SMB and RDP as well as applications that may be used within internal networks such as MySQL and web server services. Additionally, there have been a number of vulnerabilities in VMware vCenter installations, which may enable threat actors to move laterally from the compromised vCenter server to virtual machines or even to ESXi hypervisors.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.