Home/ MITRE Matrix/ Lateral Movement/ T1021

T1021Remote Services

T1021 — Remote Services is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 8 detection use cases covering it and 3 threat-intel articles citing it.

Lateral Movement

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

3Articles

8Sub-techniques

1Tactic

Sub-techniques (8)

T1021.007 · Cloud Services T1021.008 · Direct Cloud VM Connections T1021.003 · Distributed Component Object Model T1021.001 · Remote Desktop Protocol T1021.002 · SMB/Windows Admin Shares T1021.004 · SSH T1021.005 · VNC T1021.006 · Windows Remote Management

Use cases covering this technique (8)

SSRF exploited (WAF detection) Internal delivery · alerting DD Cisco IOS XE VTY Access Class Tampering ESCU actions · hunting P ESXi Shell Access Enabled ESCU actions · alerting P Enable RDP In Other Port Number ESCU actions · alerting P Cisco Network Interface Modifications ESCU actions · hunting P Cisco Secure Firewall - Communication Over Suspicious Ports ESCU actions · hunting P [LLM] Successful IPMI/BMC login from unexpected source using default ADMIN/root accounts Bespoke actions · hunting SPDD [LLM] redis-server initiates unexpected outbound / lateral connections (post-RCE egress) Bespoke actions · hunting DSPCS

Articles citing this technique (3)

crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login art-44

crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say art-105

crit OceanLotus: From external espionage to domestic targeting art-342