Remote Services T1021
Tactic: Lateral Movement
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
Events covered
80 catalog events are tagged with this technique by at least one rule.
Authoring guide
These 425 rules share fields, values, and exclusions.
Fields filtered most (282 distinct)
These fields appear most often in rule filters.
Top indicator values (2471 distinct)
These values appear most often in rule predicates.
Exclusions (1165 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 128 rules
- Access To ADMIN$ Network Share
- Active Directory honeypot used for lateral movement
- AWS Console GetSigninToken Potential Abuse
- BaaUpdate.exe Suspicious DLL Load
- Bitbucket Global SSH Settings Changed
- Bitbucket User Login Failure Via SSH
- CobaltStrike Service Installations - Security
- CobaltStrike Service Installations - System
- Copy From Or To Admin Share Or Sysvol Folder
- DCERPC SMB Spoolss Named Pipe
- DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
- DCOM lateral movement (via MMC20)
- Denied Access To Remote Desktop
- Denied RDP login with valid credentials
- Enable Windows Remote Management
- Execute Invoke-command on Remote Host
- First Time Seen Remote Named Pipe
- First Time Seen Remote Named Pipe - Zeek
- HackTool - NetExec Execution
- HackTool - NetExec File Indicators
- HackTool - Potential Impacket Lateral Movement Activity
- HackTool - SharpMove Tool Execution
- HackTool - WinRM Access Via Evil-WinRM
- Hermetic Wiper TG Process Patterns
- Impacket DCOMexec privilege abuse via MMC
- Impacket DCOMexec process abuse via MMC
- Impacket PsExec Execution
- Impacket WMIexec execution via SMB admin share
- Lateral movement by mounting a network share - net use (command)
- Lateral movement detection (based on "special groups" feature)
- macOS File Transfer Tool Execution
- macOS Network Share Access
- macOS Remote Execution Tools
- macOS Screen Sharing Session
- macOS SSH Connection Detection
- Metasploit Or Impacket Service Installation Via SMB PsExec
- Metasploit SMB Authentication
- MMC Spawning Windows Shell
- MMC20 Lateral Movement
- Net.EXE Execution
- Network share manipulation via commandline
- New network file share created
- New Remote Desktop Connection Initiated Via Mstsc.EXE
- Number of oustanding SMB requests increased
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647
- OpenCanary - FTP Login Attempt
- OpenCanary - RDP New Connection Attempt
- OpenCanary - SMB File Open Request
- OpenCanary - SNMP OID Request
- OpenCanary - SSH Login Attempt
- OpenCanary - SSH New Connection Attempt
- OpenCanary - VNC Connection Attempt
- OpenEDR Spawning Command Shell
- OpenSSH native server feature installation
- OpenSSH Server Listening On Socket
- OpenSSH server listening on socket
- OpenSSH service activation on Windows
- Outbound RDP Connections Over Non-Standard Tools
- Password Provided In Command Line Of Net.EXE
- Port Forwarding Activity Via SSH.EXE
- Potential CobaltStrike Service Installations - Registry
- Potential DCOM InternetExplorer.Application DLL Hijack
- Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
- Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
- Potential Lateral Movement via Windows Remote Shell
- Potential Remote Desktop Tunneling
- Potential Remote PowerShell Session Initiated
- Potential Tampering With RDP Related Registry Keys Via Reg.EXE
- Privilege Escalation via Named Pipe Impersonation
- Protected Storage Service Access
- Psexec Execution
- PSexec execution over SMB share
- PUA - CSExec Default Named Pipe
- PUA - RemCom Default Named Pipe
- Publicly Accessible RDP Service
- RDP BlueeKeep connection closed (CVE-2019-0708)
- RDP discovery performed on multiple hosts
- RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
- RDP Login from Localhost
- RDP Over Reverse SSH Tunnel
- RDP over Reverse SSH Tunnel WFP
- RDP reconnaissance with valid credentials performed on multiple hosts
- RDP shadow session configuration enabled (registry)
- RDP shadow session started (command)
- RDP shadow session started (native)
- RDP to HTTP or HTTPS Target Ports
- RDP tunneling configuration enabled for port forwarding
- RDP tunneling detected
- RDP tunneling via ngrok detected
- Remote DCOM/WMI Lateral Movement
- Remote LSASS Process Access Through Windows Remote Management
- Remote PowerShell Session (PS Classic)
- Remote PowerShell Session (PS Module)
- Remote PowerShell Session Host Process (WinRM)
- Remote Service Activity via SVCCTL Named Pipe
- Remote shell execution via SMB admin share
- Rundll32 Execution Without Parameters
- Rundll32 UNC Path Execution
- Shared printer creation (PrintNightmare vulnerability - CVE-2021-36958)
- SMB admin share accessed
- SMB Create Remote File Admin Share
- SMB insecure guest authentication activated (native)
- SMB Spoolss Name Piped Usage
- smbexec.py Service Installation
- Suspicious BitLocker Access Agent Update Utility Execution
- Suspicious New-PSDrive to Admin Share
- Suspicious Non PowerShell WSMAN COM Provider
- Suspicious permissions modification on a network share
- Suspicious Plink Port Forwarding
- Suspicious PsExec Execution
- Suspicious PsExec Execution - Zeek
- Suspicious RDP Redirect Using TSCON
- Suspicious Speech Runtime Binary Child Process
- Suspicious UltraVNC Execution
- Suspicious WSMAN Provider Image Loads
- T1047 Wmiprvse Wbemcomn DLL Hijack
- Turla Group Lateral Movement
- Unsigned or Unencrypted SMB Connection to Share Established
- User Added to Remote Desktop Users Group
- Windows Admin Share Mount Via Net.EXE
- Windows Internet Hosted WebDav Share Mount Via Net.EXE
- Windows Share Mount Via Net.EXE
- WinRM listening service reconnaissance (process)
- WinRM listening service reconnaissance (WS-Management)
- Winrs Local Command Execution
- WinRS usage for remote execution
- Wmiprvse Wbemcomn DLL Hijack
- Wmiprvse Wbemcomn DLL Hijack - File
Elastic 116 rules
- Accepted Default Telnet Port Connection
- At.exe Command Lateral Movement
- Attempt to Mount a Remote WebDav Share
- Attempt to Mount SMB Share via Command Line
- AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization
- AWS EC2 Instance Connect SSH Public Key Uploaded
- AWS EC2 Instance Console Login via Assumed Role
- AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity
- AWS SSM Session Started to EC2 Instance
- Azure VM Serial Console Connection with Unusual User and ASN
- Connection to External Network via Telnet
- Connection to Internal Network via Telnet
- Deprecated - PowerShell Script with Remote Execution Capabilities via WinRM
- Execution of a File Dropped from SMB
- Execution of a File Dropped from SMB via Services
- Execution via DCOM Excel Application
- Execution via TSClient Mountpoint
- High Mean of Process Arguments in an RDP Session
- High Mean of RDP Session Duration
- High Variance in RDP Session Duration
- ImageLoad of a File dropped via SMB
- Incoming DCOM Lateral Movement via MSHTA
- Incoming DCOM Lateral Movement with MMC
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows
- Incoming Execution via PowerShell Remoting
- Incoming Execution via WinRM Remote Shell
- Kubelet API Connection Attempt to Internal IP
- Lateral Execution via DCOM Office Application
- Lateral Movement via Startup Folder
- Linux SSH X11 Forwarding
- Mounting Hidden or WebDav Remote Shares
- Network Connection Initiated by Suspicious SSHD Child Process
- Network-Level Authentication (NLA) Disabled
- NullSessionPipe Registry Modification
- Outbound Scheduled Task Activity via PowerShell
- Potential Direct Kubelet Access via Process Arguments
- Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers
- Potential Execution via SSH Backdoor
- Potential HackersChoice Tool Downloaded
- Potential Internal Linux SSH Brute Force Detected
- Potential Lateral Movement via SMBExec
- Potential Lateral Tool Transfer via SMB Share
- Potential Machine Account Relay Attack via SMB
- Potential Network Share Discovery
- Potential Outgoing RDP Connection by Unusual Process
- Potential PowerShell HackTool Script by Function Names
- Potential Ransomware Behavior - Note Files by System
- Potential Ransomware Note File Dropped via SMB
- Potential Remote Credential Access via Registry
- Potential Remote Desktop Shadowing Activity
- Potential Remote Desktop Tunneling Detected
- Potential Remote Execution via IMsiServer
- Potential SharpRDP Behavior
- Potential SSH Reverse Port Forwarding
- Potential THC Tool Downloaded
- Powershell Execution via Named Pipe
- Protected Storage Service Access via SMB
- PsExec Network Connection
- Quick Assist Full Control Sharing Mode Enabled
- RDP (Remote Desktop Protocol) from the Internet
- RDP Enabled via Registry
- Remote Desktop Enabled in Windows Firewall by Netsh
- Remote Execution via File Shares
- Remote File Copy to a Hidden Share
- Remote File Creation in World Writeable Directory
- Remote Scheduled Task Creation
- Remote Scheduled Task Creation via RPC
- Remote SSH Login Enabled via systemsetup Command
- Remote Windows Service Installed
- Remotely Started Services via RPC
- Renaming of OpenSSH Binaries
- RPC (Remote Procedure Call) to the Internet
- Script Execution from WebDav
- Sensitive File Access - Remote Desktop Connection Manager
- Sensitive File Access - SSH Saved Keys
- Service Command Lateral Movement
- SMB Connections via LOLBin or Untrusted Process
- Spike in Number of Connections Made from a Source IP
- Spike in Number of Connections Made to a Destination IP
- Spike in Number of Processes in an RDP Session
- SSH Authorized Key File Activity Detected via Defend for Containers
- SSH Authorized Keys File Activity
- SSH Key Generated via ssh-keygen
- Successful SSH Authentication from Unusual IP Address
- Successful SSH Authentication from Unusual SSH Public Key
- Successful SSH Authentication from Unusual User
- Suspicious Cmd Execution via WMI
- Suspicious Credential Files Creation via Kerberos
- Suspicious Execution from a WebDav Share
- Suspicious Execution via DCOM
- Suspicious Execution via IHxHelpPaneServer
- Suspicious File Renamed via SMB
- Suspicious Image Load from SMB Shares
- Suspicious NullSessionPipe Registry Modification
- Suspicious Process Execution via Renamed PsExec Executable
- Suspicious RDP ActiveX Client Loaded
- Suspicious Remote Registry Access via SeBackupPrivilege
- Suspicious Remote Registry Modification
- Unexpected SMB Connection from User-mode Process
- Unsigned File Execution via Network Logon
- Unusual AWS Command for a User
- Unusual Azure Activity Logs Event for a User
- Unusual GCP Event for a User
- Unusual Remote Desktop Client Process
- Unusual Remote File Creation
- Unusual Source IP for a User to Logon from
- Unusual SSH Parent/Child Execution
- Unusual SSHD Child Process
- Unusual Time or Day for an RDP Session
- Unusual Windows Network Activity
- Unusual Windows Remote User
- Virtual Private Network Connection Attempt
- VNC (Virtual Network Computing) to the Internet
- Windows Registry File Creation in SMB Share
- WMI Incoming Lateral Movement
- WMIC Remote Command
Splunk 103 rules
- Allow Inbound Traffic By Firewall Rule Registry
- Allow Inbound Traffic In Firewall Rule
- Cisco IOS XE Remote Access Probe Burst
- Cisco IOS XE VTY Access Class Tampering
- Cisco Network Interface Modifications
- Cisco Privileged Account Creation with HTTP Command Execution
- Cisco Privileged Account Creation with Suspicious SSH Activity
- Cisco Secure Firewall - Communication Over Suspicious Ports
- Cisco Secure Firewall - SSH Connection to Non-Standard Port
- Cisco Secure Firewall - SSH Connection to sshd_operns
- Detect PsExec With accepteula Flag
- Enable RDP In Other Port Number
- ESXi Shell Access Enabled
- ESXi SSH Enabled
- Executable File Written in Administrative SMB Share
- Impacket Lateral Movement Activity (Sysmon)
- Impacket Lateral Movement Activity (Windows Event Log)
- Impacket Lateral Movement Commandline Parameters
- Impacket Lateral Movement smbexec CommandLine Parameters
- Impacket Lateral Movement WMIExec Commandline Parameters
- Impacket PSexec (Windows Event Log)
- Impacket SMBexec (Windows Event Log)
- Interactive Session on Remote Endpoint with PowerShell
- Invoke-DCOM.ps1 - PowerShell (PowerShell)
- Invoke-DCOM.ps1 - PowerShell (Sysmon)
- Invoke-DCOM.ps1 - PowerShell (Windows Event Log)
- Linux SSH Remote Services Script Execute
- Microsoft Intune Device Health Scripts
- Microsoft Intune DeviceManagementConfigurationPolicies
- Microsoft Intune Manual Device Management
- Microsoft Intune Mobile Apps
- Mmc LOLBAS Execution Process Spawn
- MSTSC Execution (Windows Event Log)
- Net.exe Use with URL (Sysmon)
- Net.exe Use with URL (Windows Event Log)
- Possible Lateral Movement PowerShell Spawn
- Potential EternalBlue via Metasploit (Windows Event Log)
- Potential Lateral Movement via SMB (Sysmon)
- Potential Lateral Movement via SMB (Windows Event Log)
- Powershell Remote Services Add TrustedHost
- PowerShell: SMBExec Script (PowerShell)
- RDP Connection (Sysmon)
- RDP Connection (Windows Event Log)
- RDP Enabled (PowerShell)
- RDP Enabled (Sysmon)
- RDP Enabled (Windows Event Log)
- RDP File Executed from Outlook Temp Directory (Sysmon)
- RDP File Executed from Outlook Temp Directory (Windows Event Log)
- RDP File Written by Outlook (Sysmon)
- RDP File Written by Outlook (Windows Event Log)
- RDP Logon_Logoff Event (Windows Event Log)
- Remote Admin Tools (PowerShell)
- Remote Admin Tools (Sysmon)
- Remote Admin Tools (Windows Event Log)
- Remote Desktop Network Traffic
- Remote Desktop Process Running On System
- Remote Process Instantiation via DCOM and PowerShell
- Remote Process Instantiation via DCOM and PowerShell Script Block
- Remote Process Instantiation via WinRM and PowerShell
- Remote Process Instantiation via WinRM and PowerShell Script Block
- Remote Process Instantiation via WinRM and Winrs
- SMB Traffic Spike
- SMB Write Access on Administrative Share (Windows Event Log)
- SSH Pivoting
- Windows Admin$ Share Access (Sysmon)
- Windows Admin$ Share Access (Windows Event Log)
- Windows Azure PowerShell Module Installation Via PowerShell Script
- Windows C$ Share Access (Sysmon)
- Windows C$ Share Access (Windows Event Log)
- Windows Default RDP File Creation By Non MSTSC Process
- Windows Default Rdp File Unhidden
- Windows Excel Spawning Microsoft Project Application
- Windows External Remote Login (Windows Event Log)
- Windows IPC$ Share Access (Sysmon)
- Windows IPC$ Share Access (Windows Event Log)
- Windows MSTSC RDP Commandline
- Windows Process Execution From RDP Share
- Windows Protocol Tunneling with Plink
- Windows PUA Named Pipe
- Windows PuTTY Suite Utility Execution
- Windows RDP Bitmap Cache File Creation
- Windows RDP Client Launched with Admin Session
- Windows RDP File Execution
- Windows RDP Login Session Was Established
- Windows RDP Server Registry Entry Created
- Windows Remote Host Computer Management Access
- Windows Remote Management Execute Shell
- Windows Remote Service Rdpwinst Tool Execution
- Windows Remote Services Allow Rdp In Firewall
- Windows Remote Services Allow Remote Assistance
- Windows Remote Services Rdp Enable
- Windows RMM Named Pipe
- Windows Share Multiple File Access (Windows Event Log)
- Windows Special Privileged Logon On Multiple Hosts
- Windows SpeechRuntime COM Hijacking DLL Load
- Windows SpeechRuntime Suspicious Child Process
- Windows Suspicious C2 Named Pipe
- Windows Suspicious Named Pipe
- Windows Theme File Creation in Unusual Location
- WinRM Tools (PowerShell)
- WinRM Tools (Sysmon)
- WinRM Tools (Windows Event Log)
- Wsmprovhost LOLBAS Execution Process Spawn
Kusto 55 rules
- A host is potentially running a hacking tool (ASIM Web Session schema)
- Anomaly in SMB Traffic(ASIM Network Session schema)
- ApexOne - Inbound remote access connection
- AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports
- Cisco Cloud Security - Hack Tool User-Agent Detected
- Darktrace Model Alert
- Dataverse - TI map IP to DataverseActivity
- DCOM Lateral Movement
- Detect Custom Script or Run Command deployment by risky user
- Detect executable drops via Azure custom script extension
- Detect first time Azure Custom Script or Run Command deployment
- Detect process drops via Azure Custom Script Extension performing lateral movement
- Detect service account login on new device
- Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device
- Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device
- Detect Unknown process launched via WinRM
- Detect Unknown process using SMB or WinRM
- Detecting Macro Invoking ShellBrowserWindow COM Objects
- Excessive Blocked Traffic Events Generated by User
- GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports
- Google SecOps - Detection Alerts
- Google SecOps - Multi-Event Correlated Alert
- Hunt for ADWS requests from unknown devices
- Hunt for devices doing first RDP session
- Hunt for RDP sessions to unmanaged and non TPM devices
- Illusive Incidents Analytic Rule
- Lateral Movement via DCOM
- Multiple RDP connections from Single System
- Pathlock TDnR - HANA Standalone DB Connection Events
- Pathlock TDnR - RFC Connection Changes
- Pathlock TDnR - SAP Cloud Connector Events
- Pathlock TDnR - SAP RFC Gateway Events
- Pathlock TDnR - SAP Router Log Events
- Powershell Empire Cmdlets Executed in Command Line
- Rare RDP Connections
- RDP Nesting
- Remote Desktop Protocol - SharpRDP
- SAP BTP - Cloud Integration JDBC data source changes
- SMB/Windows Admin Shares
- SonicWall - Allowed SSH, Telnet, and RDP Connections
- Tailscale Premium: Mass fan-out from single node
- Tailscale: Device started advertising subnet routes
- Tailscale: Device Tailscale SSH newly enabled
- Vectra Account's Behaviors
- Vectra AI Detect - Detections with High Severity
- Vectra AI Detect - New Campaign Detected
- Vectra AI Detect - Suspected Compromised Account
- Vectra AI Detect - Suspected Compromised Host
- Vectra AI Detect - Suspicious Behaviors by Category
- Vectra Host's Behaviors
- Vectra RUX - Create Incident for Escalated Host Detection or Unresolved Priority Host
- VMware ESXi - SSH Enable on ESXi Host
- WinRM Plugin Lateral Movement
- WMI Spawning Suspicious Child Process (Living off the Land)
- Zero Networks Segment - Rare JIT Rule Creation
YARA-L 7 rules
- Copy From Or To Admin Share Or Sysvol Folder
- MITRE ATT&CK T1021.002 Windows Admin Share Basic
- MITRE ATT&CK T1021.002 Windows Admin Share With Asset Entity
- MITRE ATT&CK T1021.002 Windows Admin Share With User Enrichment
- MITRE ATT&CK T1021.002 Windows Admin Share With User Entity
- O365 Persistent Login Activity To Azure AD PowerShell App
- Potential Remote PowerShell Session Initiated
Panther 16 rules
- AWS Console GetSigninToken Potential Abuse
- AWS EC2 Multi Instance Connect
- AWS Network ACL Restricts SSH
- Databricks Access to Multiple Workspaces
- Databricks Mount Point Creation
- EKS Audit Log Reporting system Namespace is Used From A Public IP
- GitHub pull_request_target Workflow on Self-Hosted Runner
- GitHub Workflow Using Self-Hosted Runner
- Intune Create or Modify Client App
- Intune New Device Management Script
- Kubernetes Role With Pod Exec Permissions Created
- Kubernetes System Principal Accessed from Non-Cloud Public IP
- MongoDB access allowed from anywhere
- OSQuery Detected SSH Listener
- Signal - VPC Flow Logs Allowed SSH
- Wiz Issue WITH SSH to EC2 Instance