[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1210":3},{"item":4,"lessons":18,"controls":48,"related":78},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1210","T1210","Exploitation of Remote Services",7,"MITRE","**What attackers do.** Attackers exploit vulnerabilities in internal network services, such as file sharing, remote desktop or database services, to gain access to other systems after they are already inside. This serves the Lateral Movement tactic.\n\n**How to defend.** Patch internal systems as well as internet-facing ones, segment networks so that workstations cannot reach server management services, and disable unneeded services and legacy protocols. Network detection and intrusion prevention systems can catch exploitation of known vulnerabilities. Prioritise patches for internal services with known exploits, as these are favoured by ransomware groups.\n\n**Signs to look for.** Look for exploit signatures in internal network traffic, services crashing and restarting, and new processes started by network services. A common gap is assuming internal services are safe because they are not exposed to the internet.","Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.\n\nAn adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Discovery or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities,  or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.\n\nThere are several well-known vulnerabilities that exist in common services such as SMB and RDP as well as applications that may be used within internal networks such as MySQL and web server services. Additionally, there have been a number of vulnerabilities in VMware vCenter installations, which may enable threat actors to move laterally from the compromised vCenter server to virtual machines or even to ESXi hypervisors.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1210\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"clingstun-linux-backdoor-exploits-dozens-of-flaws-via-stealthy-stun-protocol","ClingSTUN Linux Backdoor Exploits Dozens of Flaws via Stealthy STUN Protocol","2026-10-05T14:20:55.456+00:00",{"slug":25,"title":26,"published_at":27},"citrix-netscaler-zero-days-exploited-to-deploy-web-shells","Citrix NetScaler Zero-Days Exploited to Deploy Web Shells","2026-09-29T20:20:57.801+00:00",{"slug":29,"title":30,"published_at":31},"critical-rce-flaw-in-n-central-rmm-demands-urgent-patching","Critical RCE Flaw in N-central RMM Demands Urgent Patching","2026-09-07T10:20:25.834+00:00",{"slug":33,"title":34,"published_at":35},"hijacked-screenconnect-instances-spread-worm-like-malware-across-networks","Hijacked ScreenConnect Instances Spread Worm-Like Malware Across Networks","2026-09-03T19:20:59.39+00:00",{"slug":37,"title":38,"published_at":39},"known-linux-kernel-flaw-exploited-for-privilege-escalation-on-openai-systems","Known Linux Kernel Flaw Exploited for Privilege Escalation on OpenAI Systems","2026-08-28T14:21:17.756+00:00",{"slug":41,"title":42,"published_at":43},"artifactory-zero-day-exploited-by-ai-models-leading-to-hugging-face-breach","Artifactory Zero-Day Exploited by AI Models, Leading to Hugging Face Breach","2026-07-28T14:20:18.738+00:00",{"slug":45,"title":46,"published_at":47},"ai-worm-exploits-local-models-to-autonomously-compromise-networks","AI Worm Exploits Local Models to Autonomously Compromise Networks","2026-06-09T14:21:28.678+00:00",[49,54,59,64,68,73],{"slug":50,"name":51,"problem":52,"stories":53},"patch-management","Automated patch management","Known holes get closed in days, not months.",6,{"slug":55,"name":56,"problem":57,"stories":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":60,"name":61,"problem":62,"stories":63},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",3,{"slug":65,"name":66,"problem":67,"stories":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":69,"name":70,"problem":71,"stories":72},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",2,{"slug":74,"name":75,"problem":76,"stories":77},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,[79,84,89,93,97,102,107,111],{"family":80,"item":81,"code":82,"title":83,"together":9},"nist-800-53","sc-7","SC-7","Boundary Protection",{"family":85,"item":86,"code":87,"title":88,"together":9},"cis","7","Control 7","Continuous Vulnerability Management",{"family":85,"item":90,"code":91,"title":92,"together":9},"12","Control 12","Network Infrastructure Management",{"family":80,"item":94,"code":95,"title":96,"together":53},"si-2","SI-2","Flaw Remediation",{"family":85,"item":98,"code":99,"title":100,"together":101},"13","Control 13","Network Monitoring and Defense",4,{"family":103,"item":104,"code":105,"title":106,"together":101},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",{"family":108,"item":109,"code":110,"title":110,"together":63},"itil","overview","ITIL",{"family":80,"item":112,"code":113,"title":114,"together":72},"ac-6","AC-6","Least Privilege"]