External Remote Services `T1133`

Tactics: Persistence, Initial Access

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Events covered

19 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 2	A process changed a file creation time
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4778	A session was reconnected to a Window Station.
Security-Auditing	Event ID 4779	A session was disconnected from a Window Station.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
ESF	exec	Process Execution (Notify)
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
TerminalServices-ClientActiveXCore	Event ID 1024	RDP ClientActiveX is trying to connect to the server (Value).
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

Patterns shared across the 216 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (196 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`EventType`	18	`eq` 11, `contains` 5, `in` 4	`type`, `AuthorizeSecurityGroupIngress`, `login to sra`, `ssh_login`, `Attack`
`HttpRequestMethod`	16	`eq` 10, `in` 8, `contains` 1	`GET`, `POST`, `PUT`, `HEAD`, `OPTIONS`
`c-uri`	15	`contains` 11, `in` 5, `eq` 1	`${`, `%2F%7B`, `.jsp?cmd=`, `/app?service=direct/1/PrinterDetails/printerOptionsTab.tab`, `/app?service=direct/1/PrinterList/selectPrinter&sp=*`
`EventID`	11	`eq` 11	`4688`, `4778`, `4779`, `5156`, `1024`
`Status`	11	`eq` 11	`open`, `FAILED`
`cs-method`	11	`eq` 9, `in` 2	`GET`, `POST`, `HEAD`, `PUT`
`data_stream.dataset`	11	`eq` 10, `in` 1	`aws.cloudtrail`, `network_traffic.flow`, `fortinet_fortigate.log`, `kubernetes.audit_logs`, `okta.system`
`HttpStatusCode`	10	`ge` 9, `le` 9, `eq` 1	`500`, `400`, `499`, `599`, `100`
`HttpUserAgentOriginal`	10	`contains` 5, `is_not_null` 4, `is_null` 2	`.nasl`, `(bot for jce)`, `(hydra)`, `advanced email extractor`, `360spider`
`process_name`	10	`eq` 5, `in` 4, `match` 1	`java.exe`, `cmd.exe`, `javaw.exe`, `(?i)rdpclip.exe`, `(?i)tstheme.exe`
`UrlOriginal`	9	`contains` 6, `regex_match` 3, `eq` 1, `is_not_null` 1	`%26%20%64%69%72`, `%26%64%69%72`, `%2f%62%69%6e%2f%62%61%73%68`, `(10\.\d{1,3}\.\d{1,3}\.\d{1,3})\|(172\.1[6-9]\.\d{1,3}\.\d...`, `/%2e%2e/`
`src_ip`	9	`cidr_match` 4, `eq` 3, `is_not_null` 3, `ne` 2, `contains` 1	`10.0.0.0/8`, `127.0.0.0/8`, `-`, `0.0.0.0`, `127.0.0.1`
`DestinationPort`	8	`eq` 4, `match` 2, `ge` 1, `in` 1, `le` 1	`(?i)3389\|rdp`, `1099`, `11434`, `135`, `1389`
`EventResourceId`	8	`eq` 8	`TRAFFIC`, `THREAT`
`Image`	8	`ends_with` 7, `eq` 1	`/teamviewer_desktop`, `\dns.exe`, `\arcsoc.exe`, `\cmd.exe`, `\conhost.exe`

Top indicator values (938 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`HttpRequestMethod`	`eq`	`GET` kustoApache - Apache 2.4.49 flaw CVE-2021-41773 kustoCloudflare - Multiple error requests from single source kustoCloudflare - Multiple error requests from single source kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected URI kustoCloudflare - Unexpected URI kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoTomcat - Put file and get file from same IP address	10	12
`HttpRequestMethod`	`in`	`POST` kustoApache - Put suspicious file kustoCloudflare - XSS probing pattern in request kustoCloudflare - XSS probing pattern in request kustoImperva - Forbidden HTTP request method in request kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoOracle - Put suspicious file kustoTomcat - Put file and get file from same IP address	8	12
`HttpRequestMethod`	`in`	`PUT` kustoApache - Put suspicious file kustoCloudflare - XSS probing pattern in request kustoCloudflare - XSS probing pattern in request kustoImperva - Forbidden HTTP request method in request kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoOracle - Put suspicious file kustoTomcat - Put file and get file from same IP address	8	12
`Reason`	`eq`	`NEW_ALERT` kustoPalo Alto Prisma Cloud - High risk score alert kustoPalo Alto Prisma Cloud - High severity alert opened for several days kustoPalo Alto Prisma Cloud - Maximum risk score alert kustoPalo Alto Prisma Cloud - Network ACL allow all outbound traffic kustoPalo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports kustoPalo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic	6	8
`Status`	`eq`	`open` kustoPalo Alto Prisma Cloud - High risk score alert kustoPalo Alto Prisma Cloud - High severity alert opened for several days kustoPalo Alto Prisma Cloud - Maximum risk score alert kustoPalo Alto Prisma Cloud - Network ACL allow all outbound traffic kustoPalo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports kustoPalo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic	6	9
`Status`	`eq`	`FAILED` kustoSailPointIdentityNowEventType kustoSailPointIdentityNowEventTypeTechnicalName kustoSailPointIdentityNowFailedEvents kustoSailPointIdentityNowFailedEventsBasedOnTime kustoSailPointIdentityNowUserWithFailedEvent	5	5
`event.outcome`	`eq`	`success` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS RDS DB Instance Made Public elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added elasticSuccessful SSH Authentication from Unusual SSH Public Key elasticSuccessful SSH Authentication from Unusual User	6	251
`EventResourceId`	`eq`	`TRAFFIC` kustoPaloAlto - Dropping or denying session with traffic kustoPaloAlto - Forbidden countries kustoPaloAlto - Inbound connection to high risk ports kustoPaloAlto - MAC address conflict kustoPaloAlto - Possible flooding	5	6
`HttpStatusCode`	`ge`	`500` kustoApache - Multiple server errors from single IP kustoNGINX - Multiple server errors from single IP address kustoOracle - Multiple server errors from single IP kustoTomcat - Multiple server errors from single IP address kustoTomcat - Server errors after multiple requests from same IP	5	5
`HttpStatusCode`	`ge`	`400` kustoApache - Multiple client errors from single IP kustoNGINX - Multiple client errors from single IP address kustoOracle - Multiple client errors from single IP kustoTomcat - Multiple client errors from single IP address	4	4
`HttpStatusCode`	`le`	`599` kustoApache - Multiple server errors from single IP kustoNGINX - Multiple server errors from single IP address kustoOracle - Multiple server errors from single IP kustoTomcat - Multiple server errors from single IP address kustoTomcat - Server errors after multiple requests from same IP	5	5
`HttpStatusCode`	`le`	`499` kustoApache - Multiple client errors from single IP kustoNGINX - Multiple client errors from single IP address kustoOracle - Multiple client errors from single IP kustoTomcat - Multiple client errors from single IP address	4	4
`HttpUserAgentOriginal`	`contains`	`havij` kustoApache - Known malicious user agent kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	5	5
`HttpUserAgentOriginal`	`contains`	`nikto` kustoApache - Known malicious user agent kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	5	5
`HttpUserAgentOriginal`	`contains`	`advanced email extractor` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`bfac` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`brutus` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`cgichk` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`cisco-torch` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`datacha0s` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`dirbuster` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`fantombrowser` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`fantomcrew` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`grabber` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`internet ninja` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`masscan` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`UrlOriginal`	`contains`	`whoami` kustoApache - Command in URI kustoApexOne - Commands in Url kustoNGINX - Command in URI kustoOracle - Command in URI kustoTomcat - Commands in URI	5	5
`cs-method`	`eq`	`GET` splunkDetect attackers scanning for vulnerable JBoss servers splunkSpring4Shell Payload URL Request splunkVMware Server Side Template Injection Hunt splunkVMware Workspace ONE Freemarker Server-side Template Injection splunkWeb JSP Request via URL	5	49
`DstBytes`	`ne`	`0` kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected URI kustoCloudflare - Unexpected URI	4	6
`DvcAction`	`eq`	`open` kustoZscaler - Forbidden countries kustoZscaler - Shared ZPA session kustoZscaler - Unexpected ZPA session duration kustoZscaler - ZPA connections outside operational hours	4	4

Exclusions (145 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`src_ip`	`cidr_match`	`10.0.0.0/8` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`127.0.0.0/8` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`169.254.0.0/16` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`172.16.0.0/12` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`192.168.0.0/16` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`fc00::/7` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network	4
`src_ip`	`cidr_match`	`fe80::/10` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network	4
`src_ip`	`cidr_match`	`::1/128` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP	3
`src_ip`	`in`	`10.0.0.0/8` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticVNC (Virtual Network Computing) from the Internet	3
`src_ip`	`in`	`100.64.0.0/10` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticVNC (Virtual Network Computing) from the Internet	3
`src_ip`	`in`	`127.0.0.0/8` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticVNC (Virtual Network Computing) from the Internet	3
`src_ip`	`in`	`169.254.0.0/16` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticVNC (Virtual Network Computing) from the Internet	3
`src_ip`	`in`	`172.16.0.0/12` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticVNC (Virtual Network Computing) from the Internet	3
`src_ip`	`in`	`192.0.0.0/24` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticVNC (Virtual Network Computing) from the Internet	3
`src_ip`	`in`	`192.0.0.0/29` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticVNC (Virtual Network Computing) from the Internet	3

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

External Remote Services `T1133`

Events covered

Authoring guide

Fields filtered most (196 distinct)

Top indicator values (938 distinct)

Exclusions (145 distinct)

Rules under this technique

Sigma 20 rules

Elastic 18 rules

Splunk 44 rules

Kusto 130 rules

Panther 4 rules

Keyboard shortcuts

Search operators

External Remote Services T1133

Events covered

Authoring guide

Fields filtered most (196 distinct)

Top indicator values (938 distinct)

Exclusions (145 distinct)

Rules under this technique

Sigma 20 rules

Elastic 18 rules

Splunk 44 rules

Kusto 130 rules

Panther 4 rules

External Remote Services `T1133`