Ember BearG1003 ↗
Uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.1
tfMITRE ATT&CK technique
Remote Services T1021
- Tactic
- Lateral Movement
- Platforms
- Linux, macOS, Windows, IaaS, ESXi
- Version
- 1.6
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributor
- Dan Borges, @1njection
Sub-techniques 8159 rules across the family · 16 mapped directly to T1021 · 7 of 8 carry rules
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.16
Detection rulesTop 16%
Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.Remote Services MITRE reference T1021
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Aquatic PandaG0143 ↗
Used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.1
Wizard SpiderG0102 ↗
Has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.1
All 3 groups for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Brute Ratel C4S1063 ↗
Has the ability to use RPC for lateral movement.1
MacMaS1016 ↗
Can manage remote screen sessions.1
StuxnetS0603 ↗
Can propagate via peer-to-peer communication and updates using RPC.1
KivarsS0437 ↗
Has the ability to remotely trigger keyboard input and mouse clicks. 1
All 4 software entries for this technique
Offense vs defense T1021
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 11Splunk ESCU (cumulative) · 5
first rule: 2020 Q4Remote Services detection strategy DET0269
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity
5 platforms
AN0750 · Windows
Logon via RDP or WMI by a user account followed by uncommon command execution, file manipulation, or lateral network connections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window between remote login and post-access activity |
| LogonUser | Limit to service accounts or privileged users for higher fidelity |
| RemoteHostList | Allowlisting known admin jumpboxes or deployment tools |
AN0751 · Linux
SSH session from new source IP followed by interactive shell or privilege escalation (e.g., sudo, su) and outbound lateral connection.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | auditd:SYSCALL | execve, USER_CMD |
| Logon Session CreationDC0067 | linux:syslog | sshd: Accepted password/publickey |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SourceIP | Limit to new/unexpected SSH source IPs |
| CommandList | Flag suspicious post-SSH command patterns |
AN0752 · macOS
Remote login via ARD or SSH followed by screensharingd process activity or modification of TCC-protected files.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | process_events |
| Logon Session CreationDC0067 | macos:unifiedlog | eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate' |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RemoteService | Differentiate ARD vs SSH access patterns |
| TargetedPath | Tunable list of sensitive directories or TCC targets |
AN0753 · IaaS
Use of cloud-based bastion or VM console session followed by commands that initiate outbound SSH or RDP sessions from the cloud instance to other environments.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session CreationDC0067 | AWS:CloudTrail | AWS ConsoleLogin, StartSession |
| Network Connection CreationDC0082 | AWS:VPCFlowLogs | Outbound connections to port 22, 3389 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SourceAssetTag | Limit detection to cloud admin/bastion hosts |
| TargetPortList | Define critical remote service ports to flag |
AN0754 · ESXi
vSphere API logins (vimService) or SSH to ESXi host followed by unauthorized shell commands or lateral remote logins from the ESXi host.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | esxi:shell | Command execution trace |
| Logon Session CreationDC0067 | esxi:vmkernel | vim.fault.*, DCUI login, SSH shell |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SessionType | Filter by DCUI, SSH, vSphere API |
| CommandPattern | Watch for remote access tool invocations (e.g., netcat, ssh) |
1 analytic
Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better blend in with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Identify process launches that contain substrings that belong to known tools and do not match the expected process names. These will help to indicate instances of tools that have been renamed.
process = search Process:Create
port_fwd = filter process where (command_line match "-R .* -pw")
scp = filter process where (command_line match "-pw .* .* .*@.*"
mimikatz = filter process where (command_line match "sekurlsa")
rar = filter process where (command_line match " -hp ")
archive = filter process where (command_line match ".* a .*")
ip_addr = filter process where (command_line match \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
output port_fwd, scp, mimikatz, rar, archive, ip_addrSplunk version of the above pseudocode, excluding the IP address search.
index=__your_sysmon_index__ EventCode=1 (CommandLine="* -R * -pw*" OR CommandLine="* -pw * *@*" OR CommandLine="*sekurlsa*" OR CommandLine="* -hp *" OR CommandLine="* a *")
Splunk version of the above pseudocode, solely for the IP address search. Note that this will likely result in many false positives, since things like software version numbers can also be valid IPv4 addresses.
index=__your_sysmon_index__ EventCode=1 |regex CommandLine=".*\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}\b.*"EQL version of the above pseudocode, excluding the IP address search.
process where subtype.create and (command_line == "* -R * -pw*" or command_line == "* -pw * *@*" or command_line == "*sekurlsa*" or command_line == "* -hp *" or command_line == "* a *")
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*(\-r.*\-pw|\-pw.*\@|sekurlsa|\-hp| a |\\d\{1\,3\}\\\.\\d\{1\,3\}\\\.\\d\{1\,3\}).*)i limit 100LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (command="* -R * -pw*" OR command="* -pw * *@*" OR command="*sekurlsa*" OR command="* -hp *" OR command="* a *")
Unit tests
CAR’s own validation procedures for this analytic.
Download and run Putty from the command line to connect to an SSH server using remote port forwarding. Note that this requires specifying your remote system password on the command line, where it will be logged and visible. It is highly recommended that you specify an incorrect password and not complete the login, or use a temporary password.
["putty.exe -pw <password> -R <port>:<host> <user>@<host>"]
Download 7zip or other archiving software you plan to monitor. Create an innocuous text file for testing, or substitute an existing file.
["7z.exe a test.zip test.txt"]
AuditM1047
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
If remote services, such as the ability to make direct connections to cloud virtual machines, are not required, disable these connection types where feasible. On ESXi servers, consider enabling lockdown mode, which disables direct access to an ESXi host and requires that the host be managed remotely using vCenter.
Prevent unnecessary remote access to file shares, hypervisors, sensitive systems, etc. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.
Use multi-factor authentication on remote service logons where possible.
Password PoliciesM1027
Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed.
Limit the accounts that may use remote services. Limit the permissions for accounts that are at higher risk of compromise; for example, configure SSH so users can only run specific programs.