T1210 Exploitation of Remote Services — ATT&CK Technique
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system. An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Discovery or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources. There are several well-known vulnerabilities that exist in common services such as SMB and RDP as well as applications that may be used within internal networks such as MySQL and web server services. Additionally, there have been a number of vulnerabilities in VMware vCenter installations, which may enable threat actors to move laterally from the compromised vCenter server to virtual machines or even to ESXi hypervisors. Depending on the permissions level of the vulnerable remote service an adversary may achieve Exploitation for Privilege Escalation as a result of lateral movement exploitation as well.
Detection coverage (23)
- WannaCry Ransomware Activity critical
- Scanner PoC for CVE-2019-0708 RDP RCE Vuln high
- Potential RDP Exploit CVE-2019-0708 medium
- Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC high
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647 high
- Possible Exploitation of Exchange RCE CVE-2021-42321 high
- Potential CVE-2023-46214 Exploitation Attempt medium
- Exploitation Attempt Of CVE-2023-46214 Using Public POC Code high
- Apache Threading Error medium
- Audit CVE Event critical
- Zerologon Exploitation Using Well-known Tools critical
- DNS Query Request By QuickAssist.EXE low
- HackTool - SharpWSUS/WSUSpendu Execution high
- Suspicious SysAidServer Child medium
- Terminal Service Process Spawn high
- Splunk RCE Through Arbitrary File Write to Windows System Root
- Splunk RCE via User XSLT
- Active Directory Lateral Movement Identified
- Detect Computer Changed with Anonymous Account
- Cisco Secure Firewall - Lumma Stealer Activity
- Cisco Secure Firewall - Static Tundra Smart Install Abuse
- Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity
- VMWare Aria Operations Exploit Attempt
Malware using this technique
- Flame
- WannaCry
- Stuxnet
- QakBot
- Emotet
- Empire
- Bad Rabbit
- NotPetya
- Conficker
- Lucifer
- InvisiMole
- PoshC2
- TrickBot