Home/ MITRE Matrix/ Lateral Movement/ T1021

T1021Remote Services

T1021 — Remote Services is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 8 detection use cases covering it and 3 threat-intel articles citing it.

Lateral Movement

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

3Articles

8Sub-techniques

1Tactic

Sub-techniques (8)

T1021.007 · Cloud Services T1021.008 · Direct Cloud VM Connections T1021.003 · Distributed Component Object Model T1021.001 · Remote Desktop Protocol T1021.002 · SMB/Windows Admin Shares T1021.004 · SSH T1021.005 · VNC T1021.006 · Windows Remote Management

Use cases covering this technique (8)

SSRF exploited (WAF detection) Internal delivery · alerting DD Cisco IOS XE VTY Access Class Tampering ESCU actions · hunting P ESXi Shell Access Enabled ESCU actions · alerting P Enable RDP In Other Port Number ESCU actions · alerting P Cisco Network Interface Modifications ESCU actions · hunting P Cisco Secure Firewall - Communication Over Suspicious Ports ESCU actions · hunting P [LLM] Inbound non-loopback connection to Nuxt/Vite dev server (node.exe HMR port) Bespoke delivery · hunting DSPCS [LLM] Fluentd RCE pod fans out to internal cluster ranges (post-exploitation lateral movement) Bespoke actions · alerting DSPDDCS

Articles citing this technique (3)

crit [GHSA / CRITICAL] CVE-2026-71319: Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host art-113

crit [GHSA / CRITICAL] CVE-2026-54680: Logging operator has Fluentd configuration injection that allows remote code execution art-176

crit OceanLotus: From external espionage to domestic targeting art-388