VOID MANTICOREG1055 ↗
Has leveraged public facing VPN infrastructure to gain initial access to victim environments.1
tfMITRE ATT&CK technique
External Remote Services T1133
- Tactics
- Initial Access, Persistence
- Platforms
- Containers, Linux, macOS, Windows
- Version
- 2.5
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- ExtraHop; David Fiser, @anu4is, Trend Micro; Alfredo Oliveira, Trend Micro; Idan Frimark, Cisco; Rory McCune, Aqua Security; Yuval Avrahami, Palo Alto Networks; Jay Chen, Palo Alto Networks; Brad Geesaman, @bradgeesaman; Magno Logan, @magnologan, Trend Micro; Ariel Shuper, Cisco; Yossi Weizman, Azure Defender Research Team; Vishwas Manral, McAfee; Daniel Oakley; Travis Smith, Tripwire; David Tayouri; Liran Ravich, CardinalOps
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
28
Threat groupsTop 6%
Threat groups94th percentile · 94% of ATT&CK techniques have this many threat groups attributed or fewer.10
CampaignsTop 3%
Campaigns97th percentile · 97% of ATT&CK techniques have this many campaigns recorded or fewer.5
Tools & malware66th pct
Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.55
Detection rulesTop 4%
Detection rules96th percentile · 96% of ATT&CK techniques have this many detection rules written or fewer.External Remote Services MITRE reference T1133
Top 6%of all ATT&CK techniques for number of groups
28 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Velvet AntG1047 ↗
Has leveraged access to internet-facing remote services to compromise and retain access to victim environments.1
Sea TurtleG1041 ↗
Has used external-facing SSH to achieve initial access to the IT environments of victim organizations.1
PlayG1040 ↗
Has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.12
AkiraG1024 ↗
Uses compromised VPN accounts for initial access to victim networks.1
Volt TyphoonG1017 ↗
Has used VPNs to connect to victim environments and enable post-exploitation actions.1
All 28 groups for this technique · 6 newest in this preview
10 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, threat actors leveraged the FortiGate VPN interface that was exposed to the internet to gain access to the victim environment.12
ArcaneDoorC0046 ↗
Used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.1
C0027C0027 ↗
During C0027, Scattered Spider used Citrix and VPNs to persist in compromised environments.1
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}.1
CostaRictoC0004 ↗
During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.1
SolarWinds CompromiseC0024 ↗
For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.12
All 10 campaigns for this technique · 6 newest in this preview
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MafaldaS1060 ↗
Can establish an SSH connection from a compromised host to a server.1
HildegardS0601 ↗
Was executed through an unsecure kubelet that allowed anonymous access to the victim environment.1
DokiS0600 ↗
Was executed through an open Docker daemon API port.1
KinsingS0599 ↗
Was executed in an Ubuntu container deployed via an open Docker daemon API.1
Linux RabbitS0362 ↗
Attempts to gain access to the server via SSH.1
All 5 software entries for this technique
Offense vs defense T1133
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 8Sigma rules (cumulative) · 20Splunk ESCU (cumulative) · 35
first rule: 2020 Q2 · 8 of 10 campaigns plotted (2015 Ukraine Electric Power Attack (dated 2015), Night Dragon (dated 2009) fall before the 2017 window)External Remote Services detection strategy DET0354
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
4 platforms
AN1004 · Windows
Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | WinEventLog:Security | EventCode=4776, 4625 |
| Application Log ContentDC0038 | WinEventLog:Application | VPN, Citrix, or remote access gateway logs showing external IP addresses |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BusinessHours | Normal business hours for logon activity. |
| KnownRemoteIPs | List of approved external IPs or VPN endpoints. |
| FailedLogonThreshold | Number of failed logons before raising suspicion (e.g., >5). |
| GeoIPWhitelist | Geographic regions allowed for remote access. |
| TimeWindow | Time window to correlate failed attempts and success (e.g., 15m). |
AN1005 · Linux
Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | NSM:Connections | Failed password or accepted password for SSH users |
| Network Connection CreationDC0082 | NSM:Flow | connection: Inbound connections to SSH or VPN ports |
| Logon Session MetadataDC0088 | auditd:SYSCALL | ssh logins or execve of remote commands |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KnownSSHClients | Legitimate IPs or client fingerprints for SSH/VPN. |
| FailedLogonThreshold | Number of failed SSH logins to trigger alert. |
| TimeWindow | Correlation window for failed attempts and success. |
AN1006 · macOS
Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | PF:Logs | External traffic to remote access services |
| Network Connection CreationDC0082 | macos:unifiedlog | Inbound connections to VNC/SSH ports |
| Logon Session MetadataDC0088 | macos:unifiedlog | Remote login (ssh) or screen sharing authentication attempts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KnownVNCServers | List of approved VNC/SSH sources. |
| TimeWindow | Time correlation between failed attempts and success. |
AN1007 · Containers
Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | ApplicationLog:API | Docker/Kubernetes API access from external sources |
| Network Connection CreationDC0082 | NSM:Flow | External access to container ports (2375, 6443) |
| Logon Session MetadataDC0088 | kubernetes:audit | Unauthorized container creation or kubelet exec logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedCIDRs | Approved external IP ranges for container APIs. |
| TimeWindow | Correlation window for API calls and container starts. |
Disable or block remotely available services that may be unnecessary.
Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.
Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of Multi-Factor Authentication Interception techniques for some two-factor authentication implementations.
Network SegmentationM1030
Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
Restrict all traffic to and from public Tor nodes.
Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition