Home/ MITRE Matrix/ Lateral Movement/ T1021

T1021Remote Services

T1021 — Remote Services is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 6 detection use cases covering it and 1 threat-intel article citing it.

Lateral Movement

View on the matrix → Filter Detection Library MITRE official spec ↗

6Use cases

1Articles

8Sub-techniques

1Tactic

Sub-techniques (8)

T1021.007 · Cloud Services T1021.008 · Direct Cloud VM Connections T1021.003 · Distributed Component Object Model T1021.001 · Remote Desktop Protocol T1021.002 · SMB/Windows Admin Shares T1021.004 · SSH T1021.005 · VNC T1021.006 · Windows Remote Management

Use cases covering this technique (6)

SSRF exploited (WAF detection) Internal delivery · alerting DD Cisco IOS XE VTY Access Class Tampering ESCU actions · hunting P ESXi Shell Access Enabled ESCU actions · alerting P Enable RDP In Other Port Number ESCU actions · alerting P Cisco Network Interface Modifications ESCU actions · hunting P Cisco Secure Firewall - Communication Over Suspicious Ports ESCU actions · hunting P

Articles citing this technique (1)

crit OceanLotus: From external espionage to domestic targeting art-54