ShinyHuntersG1057 ↗
Has exploited vulnerabilities in remote services for lateral movement.1
tfMITRE ATT&CK technique
Exploitation of Remote Services T1210
- Tactic
- Lateral Movement
- Platforms
- Linux, Windows, macOS, ESXi
- Version
- 1.2
- Created
- 18 April 2018
- Last modified
- 04 August 2026
- Contributor
- ExtraHop
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
12
Threat groupsTop 15%
Threat groups85th percentile · 85% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.13
Tools & malwareTop 23%
Tools & malware77th percentile · 77% of ATT&CK techniques have this many tools implementing them or fewer.24
Detection rulesTop 12%
Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.Exploitation of Remote Services MITRE reference T1210
Top 15%of all ATT&CK techniques for number of groups
12 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Earth LuscaG1006 ↗
Has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).1
Ember BearG1003 ↗
Has used exploits for vulnerabilities such as MS17-010, also known as Eternal Blue, during operations.1
Tonto TeamG0131 ↗
Has used EternalBlue exploits for lateral movement.1
Fox KittenG0117 ↗
Has exploited known vulnerabilities in remote services including RDP.123
Wizard SpiderG0102 ↗
Has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.123
All 12 groups for this technique · 6 newest in this preview
13 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QakBotS0650 ↗
Can move laterally using worm-like functionality through exploitation of SMB.1
ConfickerS0608 ↗
Exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.1
Bad RabbitS0606 ↗
Used the EternalRomance SMB exploit to spread through victim networks.1
StuxnetS0603 ↗
Propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.1
LuciferS0532 ↗
Can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).1
PoshC2S0378 ↗
Contains a module for exploiting SMB via EternalBlue.1
All 13 software entries for this technique · 6 newest in this preview
Offense vs defense T1210
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 15Splunk ESCU (cumulative) · 9
first rule: 2019 Q1Exploitation of Remote Services detection strategy DET0118
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Exploitation of Remote Services – multi-platform lateral movement detection
4 platforms
AN0327 · Windows
Correlates inbound network access to remote service ports (e.g., SMB/RPC 445/135, RDP 3389, WinRM 5985/5986) with near-time instability in the target service (crash, abnormal restart), suspicious child process creation under the service, and post-access lateral-movement behaviors. The chain indicates likely exploitation rather than normal administration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Application Log ContentDC0038 | WinEventLog:System | EventCode=1000 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval. |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ServicePortSet | List of monitored service ports (default: 445,135,3389,5985,5986,1433,3306). |
| TimeWindow | Correlation window between inbound access and crash/child-process (default: 10 minutes). |
| AllowedAdminCIDRs | Known management networks to suppress benign admin traffic. |
| MinConnErrorRate | Percent of failed/aborted connections to treat as anomalous (default: 30%). |
AN0328 · Linux
Links inbound network access to SSHD/SMB/NFS/Databases or custom daemons with subsequent daemon crash/restart, core dump, or spawning of shells/reverse shells from the service context, indicating remote exploitation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity. |
| Application Log ContentDC0038 | linux:syslog | kernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc. |
| Network Traffic ContentDC0085 | NSM:Flow | Inbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host. |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ServiceNames | Linux daemons to watch (sshd, smbd, nfsd, httpd/nginx, mysqld, postgres, redis). |
| CoreDumpPaths | Paths indicating crash artifacts (/var/crash, /var/lib/systemd/coredump). |
| ShellSpawnAllowlist | Paths/users allowed to spawn shells from services (default: empty). |
| TimeWindow | Correlation window (default 10m). |
AN0329 · ESXi
Detects exploitation targeting ESXi/vCenter by correlating attempts to reach known exploitable endpoints (OpenSLP 427, CIM 5989, Hostd/Vpxa HTTPS 443, ESXi SOAP) with vmkernel/hostd crashes, unexpected hostd/vpxa restarts, or new reverse/outbound connections from ESXi host/vCenter to internal assets.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | esxi:hostd | Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log. |
| Network Traffic ContentDC0085 | NSM:Flow | Inbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host. |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ESXiServicePorts | 427, 443, 902, 5989; modify per version/hardening. |
| MgmtCIDRs | Legit management networks for vCenter/ESXi. |
| RestartKeywords | Crash/restart patterns to match in logs. |
AN0330 · macOS
Ties inbound access to exposed services (ARD/VNC 5900, SSH 22, ScreenSharing, web services) with process crashes in unified logs and abnormal child processes spawned under those services (e.g., bash, curl) to indicate exploitation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | parent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes. |
| Application Log ContentDC0038 | macos:unifiedlog | process 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons. |
| Network Traffic ContentDC0085 | NSM:Flow | Inbound to 22/5900/8080 and follow-on internal connections. |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ServicePortSet | 22, 5900, 8080/8443 by default. |
| AllowedAdmins | MDM/jump-host IPs allowed to manage endpoints. |
| TimeWindow | Default: 10 minutes. |
Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist.
Minimize available services to only those that are necessary.
Exploit ProtectionM1050
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted.
Network SegmentationM1030
Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods.
Minimize permissions and access for service accounts to limit impact of exploitation.
Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.
Update SoftwareM1051
Update software regularly by employing patch management for internal enterprise endpoints and servers.
Regularly scan the internal network for available services to identify new and potentially vulnerable services.