External Remote Services `T1133`

Tactics: Persistence, Initial Access

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Events covered

20 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 2	A process changed a file creation time
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4778	A session was reconnected to a Window Station.
Security-Auditing	Event ID 4779	A session was disconnected from a Window Station.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
ESF	exec	Process Execution
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
TerminalServices-ClientActiveXCore	Event ID 1024	RDP ClientActiveX is trying to connect to the server (Value).
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 223 rules share fields, values, and exclusions.

Fields filtered most (165 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	19	`eq` 10, `contains` 5, `in` 5, `starts_with` 1	`AuthorizeSecurityGroupIngress`, `Login to SRA`, `login-success`, `ssh_login`, `ALERT_CENTER`
`HttpRequestMethod`	16	`eq` 10, `in` 8, `contains` 1	`GET`, `POST`, `PUT`, `HEAD`, `OPTIONS`
`data_stream.dataset`	16	`eq` 14, `in` 4	`aws.cloudtrail`, `network_traffic.flow`, `fortinet_fortigate.log`, `sonicwall_firewall.log`, `gcp.audit`
`c-uri`	15	`contains` 11, `in` 5, `eq` 1	`${`, `%2F%7B`, `.jsp?cmd=`, `/api/v2/cmdb/system/admin`, `*/app?service=direct/1/PrinterDetails/printerOptionsTab.tab`
`EventID`	12	`eq` 11, `in` 1	`4688`, `4778`, `4779`, `5156`, `1024`
`Status`	11	`eq` 11	`open`, `FAILED`
`cs-method`	11	`eq` 9, `in` 2	`GET`, `POST`, `HEAD`, `PUT`
`HttpUserAgentOriginal`	10	`contains` 5, `is_not_null` 4, `is_null` 2	, `(BOT for JCE)`, `(hydra)`, `.nasl`, `BFAC`
`src_ip`	10	`is_not_null` 5, `cidr_match` 4, `eq` 3, `contains` 1, `ne` 1	, `10.0.0.0/8`, `127.0.0.0/8`, `-`, `0.0.0.0`
`DestinationPort`	9	`eq` 4, `in` 2, `regex_match` 2, `ge` 1, `le` 1	`(?i)3389\|rdp`, `1099`, `11434`, `135`, `1389`
`HttpStatusCode`	9	`ge` 8, `le` 8, `eq` 1	`400`, `499`, `500`, `599`, `200`
`UrlOriginal`	9	`contains` 6, `regex_match` 3, `eq` 1, `is_not_null` 1	`%26%20%64%69%72`, `%26%64%69%72`, `%2f%62%69%6e%2f%62%61%73%68`, `(10\.\d{1,3}\.\d{1,3}\.\d{1,3})\|(172\.1[6-9]\.\d{1,3}\.\d...`,
`event.category`	9	`in` 5, `eq` 4	`network`, `network_traffic`, `authentication`, `process`
`process_basename`	9	`eq` 5, `in` 4	`java.exe`, `javaw.exe`, `MSExchangeMailboxReplication.exe`, `WindowsTerminal.exe`, `bash`
`CommandLine`	8	`contains` 4, `ends_with` 3, `regex_match` 1, `wildcard` 1	`/TeamViewer_Desktop --IPCport 5939 --Module 1`, `-Group` , `/add`, `&c=`, `&k=`

Top indicator values (957 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`HttpRequestMethod`	`eq`	`GET` kustoApache - Apache 2.4.49 flaw CVE-2021-41773 kustoCloudflare - Multiple error requests from single source kustoCloudflare - Multiple error requests from single source kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected URI kustoCloudflare - Unexpected URI kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoTomcat - Put file and get file from same IP address	10	12
`HttpRequestMethod`	`in`	`POST` kustoApache - Put suspicious file kustoCloudflare - XSS probing pattern in request kustoCloudflare - XSS probing pattern in request kustoImperva - Forbidden HTTP request method in request kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoOracle - Put suspicious file kustoTomcat - Put file and get file from same IP address	8	12
`HttpRequestMethod`	`in`	`PUT` kustoApache - Put suspicious file kustoCloudflare - XSS probing pattern in request kustoCloudflare - XSS probing pattern in request kustoImperva - Forbidden HTTP request method in request kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoOracle - Put suspicious file kustoTomcat - Put file and get file from same IP address	8	12
`Reason`	`eq`	`NEW_ALERT` kustoPalo Alto Prisma Cloud - High risk score alert kustoPalo Alto Prisma Cloud - High severity alert opened for several days kustoPalo Alto Prisma Cloud - Maximum risk score alert kustoPalo Alto Prisma Cloud - Network ACL allow all outbound traffic kustoPalo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports kustoPalo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic	6	8
`Status`	`eq`	`open` kustoPalo Alto Prisma Cloud - High risk score alert kustoPalo Alto Prisma Cloud - High severity alert opened for several days kustoPalo Alto Prisma Cloud - Maximum risk score alert kustoPalo Alto Prisma Cloud - Network ACL allow all outbound traffic kustoPalo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports kustoPalo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic	6	9
`Status`	`eq`	`FAILED` kustoSailPointIdentityNowEventType kustoSailPointIdentityNowEventTypeTechnicalName kustoSailPointIdentityNowFailedEvents kustoSailPointIdentityNowFailedEventsBasedOnTime kustoSailPointIdentityNowUserWithFailedEvent	5	5
`event.outcome`	`eq`	`success` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticGKE Exposed Service Created With Type NodePort elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added elasticSuccessful SSH Authentication from Unusual SSH Public Key elasticSuccessful SSH Authentication from Unusual User	6	306
`EventResourceId`	`eq`	`TRAFFIC` kustoPaloAlto - Dropping or denying session with traffic kustoPaloAlto - Forbidden countries kustoPaloAlto - Inbound connection to high risk ports kustoPaloAlto - MAC address conflict kustoPaloAlto - Possible flooding	5	6
`HttpUserAgentOriginal`	`contains`	`Nikto` kustoApache - Known malicious user agent kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	5	5
`HttpUserAgentOriginal`	`contains`	`havij` kustoApache - Known malicious user agent kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	5	5
`HttpUserAgentOriginal`	`contains`	`BFAC` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`advanced email extractor` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`brutus` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`cgichk` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`cisco-torch` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`datacha0s` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`dirbuster` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`fantomBrowser` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`fantomCrew` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`grabber` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`internet ninja` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`masscan` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`morfeus` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`mysqloit` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`cs-method`	`eq`	`GET` splunkDetect attackers scanning for vulnerable JBoss servers splunkSpring4Shell Payload URL Request splunkVMware Server Side Template Injection Hunt splunkVMware Workspace ONE Freemarker Server-side Template Injection splunkWeb JSP Request via URL	5	49
`event.category`	`in`	`network` elasticAccepted Default Telnet Port Connection elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	5	12
`event.category`	`in`	`network_traffic` elasticAccepted Default Telnet Port Connection elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	5	12
`src_ip`	`is_not_null`	elasticFirst Seen SonicWall Remote Access Login by User and Source elasticMultiple SonicWall Login Failures Followed by Successful Login elasticOllama API Accessed from External Network kustoOracleDBAudit - Connection to database from external IP kustoZscaler - ZPA connections from new IP	5	70
`DstBytes`	`ne`	`0` kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected URI kustoCloudflare - Unexpected URI	4	6
`DvcAction`	`eq`	`open` kustoZscaler - Forbidden countries kustoZscaler - Shared ZPA session kustoZscaler - Unexpected ZPA session duration kustoZscaler - ZPA connections outside operational hours	4	4

Exclusions (128 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`src_ip`	`cidr_match`	`10.0.0.0/8` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`127.0.0.0/8` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`169.254.0.0/16` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`172.16.0.0/12` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`192.168.0.0/16` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`fc00::/7` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network	4
`src_ip`	`cidr_match`	`fe80::/10` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network	4
`aws::userAgent`	`contains`	`Pulumi` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function URL Created with Public Access elasticAWS RDS DB Instance Made Public elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	5
`aws::userAgent`	`contains`	`Terraform` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function URL Created with Public Access elasticAWS RDS DB Instance Made Public elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	5
`src_ip`	`in`	`10.0.0.0/8` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`100.64.0.0/10` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`127.0.0.0/8` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`169.254.0.0/16` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`172.16.0.0/12` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`192.0.0.0/24` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4

External Remote Services `T1133`

Events covered

Authoring guide

Fields filtered most (165 distinct)

Top indicator values (957 distinct)

Exclusions (128 distinct)

Rules under this technique

Sigma 20 rules

Elastic 23 rules

Splunk 44 rules

Kusto 132 rules

Panther 4 rules

External Remote Services T1133

Events covered

Authoring guide

Fields filtered most (165 distinct)

Top indicator values (957 distinct)

Exclusions (128 distinct)

Rules under this technique

Sigma 20 rules

Elastic 23 rules

Splunk 44 rules

Kusto 132 rules

Panther 4 rules

External Remote Services `T1133`