{"id":"T1210","name":"Exploitation of Remote Services","url":"https://attack.mitre.org/techniques/T1210","tactics":["lateral-movement"],"platforms":["Linux","Windows","macOS","ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0118","stix_id":"x-mitre-detection-strategy--ee73dd97-cf1a-4220-a7cf-52d864811bb4","name":"Exploitation of Remote Services – multi-platform lateral movement detection","url":"https://attack.mitre.org/detectionstrategies/DET0118","analytics":[{"id":"AN0327","stix_id":"x-mitre-analytic--f8c99f4f-f61e-436c-a093-c97969c9b038","name":"Analytic 0327","description":"Correlates inbound network access to remote service ports (e.g., SMB/RPC 445/135, RDP 3389, WinRM 5985/5986) with near-time instability in the target service (crash, abnormal restart), suspicious child process creation under the service, and post-access lateral-movement behaviors. The chain indicates likely exploitation rather than normal administration.","url":"https://attack.mitre.org/detectionstrategies/DET0118#AN0327","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:System","channel":"EventCode=1000","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval.","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ServicePortSet","description":"List of monitored service ports (default: 445,135,3389,5985,5986,1433,3306)."},{"field":"TimeWindow","description":"Correlation window between inbound access and crash/child-process (default: 10 minutes)."},{"field":"AllowedAdminCIDRs","description":"Known management networks to suppress benign admin traffic."},{"field":"MinConnErrorRate","description":"Percent of failed/aborted connections to treat as anomalous (default: 30%)."}],"live":true,"detection_strategies":["DET0118"],"techniques":["T1210"]},{"id":"AN0328","stix_id":"x-mitre-analytic--70e3066e-6ba3-444b-8e88-dfc3575f2706","name":"Analytic 0328","description":"Links inbound network access to SSHD/SMB/NFS/Databases or custom daemons with subsequent daemon crash/restart, core dump, or spawning of shells/reverse shells from the service context, indicating remote exploitation.","url":"https://attack.mitre.org/detectionstrategies/DET0118#AN0328","platforms":["Linux"],"log_source_references":[{"name":"linux:syslog","channel":"kernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc.","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"linux-syslog"},{"name":"auditd:SYSCALL","channel":"execve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity.","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"Inbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host.","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ServiceNames","description":"Linux daemons to watch (sshd, smbd, nfsd, httpd/nginx, mysqld, postgres, redis)."},{"field":"CoreDumpPaths","description":"Paths indicating crash artifacts (/var/crash, /var/lib/systemd/coredump)."},{"field":"ShellSpawnAllowlist","description":"Paths/users allowed to spawn shells from services (default: empty)."},{"field":"TimeWindow","description":"Correlation window (default 10m)."}],"live":true,"detection_strategies":["DET0118"],"techniques":["T1210"]},{"id":"AN0329","stix_id":"x-mitre-analytic--17b82342-cc75-4dcd-ad98-f313cd2a2b69","name":"Analytic 0329","description":"Detects exploitation targeting ESXi/vCenter by correlating attempts to reach known exploitable endpoints (OpenSLP 427, CIM 5989, Hostd/Vpxa HTTPS 443, ESXi SOAP) with vmkernel/hostd crashes, unexpected hostd/vpxa restarts, or new reverse/outbound connections from ESXi host/vCenter to internal assets.","url":"https://attack.mitre.org/detectionstrategies/DET0118#AN0329","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log.","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"esxi-hostd"},{"name":"NSM:Flow","channel":"Inbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host.","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ESXiServicePorts","description":"427, 443, 902, 5989; modify per version/hardening."},{"field":"MgmtCIDRs","description":"Legit management networks for vCenter/ESXi."},{"field":"RestartKeywords","description":"Crash/restart patterns to match in logs."}],"live":true,"detection_strategies":["DET0118"],"techniques":["T1210"]},{"id":"AN0330","stix_id":"x-mitre-analytic--32ef36a3-3112-40a1-84d0-323b7b86cb5b","name":"Analytic 0330","description":"Ties inbound access to exposed services (ARD/VNC 5900, SSH 22, ScreenSharing, web services) with process crashes in unified logs and abnormal child processes spawned under those services (e.g., bash, curl) to indicate exploitation.","url":"https://attack.mitre.org/detectionstrategies/DET0118#AN0330","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons.","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"parent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes.","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"},{"name":"NSM:Flow","channel":"Inbound to 22/5900/8080 and follow-on internal connections.","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ServicePortSet","description":"22, 5900, 8080/8443 by default."},{"field":"AllowedAdmins","description":"MDM/jump-host IPs allowed to manage endpoints."},{"field":"TimeWindow","description":"Default: 10 minutes."}],"live":true,"detection_strategies":["DET0118"],"techniques":["T1210"]}],"live":true,"version":"1.0","techniques":["T1210"]}],"sigma_rules":[{"id":"04017cd5-621e-4ec4-a762-1f042fe3d3e5","title":"Potential CVE-2023-46214 Exploitation Attempt","author":"Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)","status":"test","level":"medium","date":"2023-11-27","modified":null,"description":"Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing\n","references":["https://github.com/nathan31337/Splunk-RCE-poc/","https://blog.hrncirik.net/cve-2023-46214-analysis","https://advisory.splunk.com/advisories/SVD-2023-1104"],"logsource":{"category":"webserver"},"tags":["attack.lateral-movement","attack.t1210","cve.2023-46214","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise.yml","techniques":["T1210"],"cves":["CVE-2023-46214"]},{"id":"1012f107-b8f1-4271-af30-5aed2de89b39","title":"Terminal Service Process Spawn","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-05-22","modified":"2023-01-25","description":"Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)","references":["https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.lateral-movement","attack.t1210","car.2013-07-002"],"path":"rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml","techniques":["T1190","T1210"],"cves":[]},{"id":"18f37338-b9bd-4117-a039-280c81f7a596","title":"Zerologon Exploitation Using Well-known Tools","author":"Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community","status":"stable","level":"critical","date":"2020-10-13","modified":"2021-05-30","description":"This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with \"kali\" hostname.","references":["https://www.secura.com/blog/zero-logon","https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382"],"logsource":{"product":"windows","service":"system"},"tags":["attack.t1210","attack.lateral-movement"],"path":"rules/windows/builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml","techniques":["T1210"],"cves":[]},{"id":"41d40bff-377a-43e2-8e1b-2e543069e079","title":"WannaCry Ransomware Activity","author":"Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro","status":"test","level":"critical","date":"2019-01-16","modified":"2025-10-18","description":"Detects WannaCry ransomware activity","references":["https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100","https://x.com/nas_bench/status/1868639048484425963"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.defense-impairment","attack.t1210","attack.discovery","attack.t1083","attack.t1222.001","attack.impact","attack.t1486","attack.t1490","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml","techniques":["T1210","T1083","T1222.001","T1486","T1490"],"cves":[]},{"id":"48d91a3a-2363-43ba-a456-ca71ac3da5c2","title":"Audit CVE Event","author":"Florian Roth (Nextron Systems), Zach Mathis","status":"test","level":"critical","date":"2020-01-15","modified":"2022-10-22","description":"Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.\nMS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.\nUnfortunately, that is about the only instance of CVEs being written to this log.\n","references":["https://twitter.com/VM_vivisector/status/1217190929330655232","https://twitter.com/DidierStevens/status/1217533958096924676","https://twitter.com/FlemmingRiis/status/1217147415482060800","https://www.youtube.com/watch?v=ebmW42YYveI","https://nullsec.us/windows-event-log-audit-cve/"],"logsource":{"product":"windows","service":"application"},"tags":["attack.execution","attack.stealth","attack.t1203","attack.privilege-escalation","attack.t1068","attack.t1211","attack.credential-access","attack.t1212","attack.lateral-movement","attack.t1210","attack.impact","attack.t1499.004"],"path":"rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml","techniques":["T1203","T1068","T1211","T1212","T1210","T1499.004"],"cves":[]},{"id":"60bfeac3-0d35-4302-8efb-1dd16f715bc6","title":"Suspicious SysAidServer Child","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-08-26","modified":null,"description":"Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)","references":["https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1210"],"path":"rules/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml","techniques":["T1210"],"cves":[]},{"id":"8400629e-79a9-4737-b387-5db940ab2367","title":"Scanner PoC for CVE-2019-0708 RDP RCE Vuln","author":"Florian Roth (Nextron Systems), Adam Bradbury (idea)","status":"test","level":"high","date":"2019-06-02","modified":"2022-12-25","description":"Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to  CVE-2019-0708 RDP RCE aka BlueKeep","references":["https://twitter.com/AdamTheAnalyst/status/1134394070045003776","https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1210","car.2013-07-002","detection.emerging-threats","cve.2019-0708"],"path":"rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_security_exploit_cve_2019_0708_scanner_poc.yml","techniques":["T1210"],"cves":["CVE-2019-0708"]},{"id":"882e858a-3233-4ba8-855e-2f3d3575803d","title":"DNS Query Request By QuickAssist.EXE","author":"Muhammad Faisal (@faisalusuf)","status":"experimental","level":"low","date":"2024-12-19","modified":null,"description":"Detects DNS queries initiated by \"QuickAssist.exe\" to Microsoft Quick Assist primary endpoint that is used to establish a session.\n","references":["https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/","https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/","https://x.com/cyb3rops/status/1862406110365245506","https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.command-and-control","attack.initial-access","attack.lateral-movement","attack.t1071.001","attack.t1210"],"path":"rules/windows/dns_query/dns_query_win_quickassist.yml","techniques":["T1071.001","T1210"],"cves":[]},{"id":"aaa5b30d-f418-420b-83a0-299cb6024885","title":"Potential RDP Exploit CVE-2019-0708","author":"Lionel PRAT, Christophe BROCAS, @atc_project (improvements)","status":"test","level":"medium","date":"2019-05-24","modified":"2022-12-25","description":"Detect suspicious error on protocol RDP, potential CVE-2019-0708","references":["https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708","https://github.com/Ekultek/BlueKeep"],"logsource":{"product":"windows","service":"system"},"tags":["attack.lateral-movement","attack.t1210","car.2013-07-002","cve.2019-0708","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_system_exploit_cve_2019_0708.yml","techniques":["T1210"],"cves":["CVE-2019-0708"]},{"id":"ab6b1a39-a9ee-4ab4-b075-e83acf6e346b","title":"OMIGOD HTTP No Authentication RCE - CVE-2021-38647","author":"Nate Guagenti (neu5ron)","status":"stable","level":"high","date":"2021-09-20","modified":"2025-11-03","description":"Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request.\nVerify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP).\nWithin the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.\n","references":["https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure","https://twitter.com/neu5ron/status/1438987292971053057?s=20"],"logsource":{"product":"zeek","service":"http"},"tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.lateral-movement","attack.t1068","attack.t1190","attack.t1203","attack.t1021.006","attack.t1210","detection.emerging-threats","cve.2021-38647"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-38647/zeek_http_exploit_cve_2021_38647_omigod_no_auth_rce.yml","techniques":["T1068","T1190","T1203","T1021.006","T1210"],"cves":["CVE-2021-38647"]},{"id":"b0ce780f-10bd-496d-9067-066d23dc3aa5","title":"HackTool - SharpWSUS/WSUSpendu Execution","author":"@Kostastsale, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-10-07","modified":"2024-08-23","description":"Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.\nWindows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.\n","references":["https://labs.nettitude.com/blog/introducing-sharpwsus/","https://github.com/nettitude/SharpWSUS","https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.lateral-movement","attack.t1210"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml","techniques":["T1210"],"cves":[]},{"id":"ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8","title":"Exploitation Attempt Of CVE-2023-46214 Using Public POC Code","author":"Lars B. P. Frydenskov(Trifork Security)","status":"test","level":"high","date":"2023-11-27","modified":null,"description":"Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code\n","references":["https://github.com/nathan31337/Splunk-RCE-poc/","https://blog.hrncirik.net/cve-2023-46214-analysis","https://advisory.splunk.com/advisories/SVD-2023-1104"],"logsource":{"category":"webserver"},"tags":["attack.lateral-movement","attack.t1210","cve.2023-46214","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise_poc.yml","techniques":["T1210"],"cves":["CVE-2023-46214"]},{"id":"c92f1896-d1d2-43c3-92d5-7a5b35c217bb","title":"Possible Exploitation of Exchange RCE CVE-2021-42321","author":"Florian Roth (Nextron Systems), @testanull","status":"test","level":"high","date":"2021-11-18","modified":"2022-07-12","description":"Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321"],"logsource":{"product":"windows","service":"msexchange-management"},"tags":["attack.lateral-movement","attack.t1210","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-42321/win_exchange_cve_2021_42321.yml","techniques":["T1210"],"cves":[]},{"id":"dcc6a01e-9471-44a0-a699-71ea96f8ed8b","title":"Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC","author":"@Kostastsale, TheDFIRReport","status":"test","level":"high","date":"2022-02-12","modified":null,"description":"Detects the execution of the commonly used ZeroLogon PoC executable.","references":["https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/","https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.lateral-movement","attack.t1210","cve.2020-1472","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-1472/proc_creation_win_exploit_cve_2020_1472_zero_poc.yml","techniques":["T1210"],"cves":["CVE-2020-1472"]},{"id":"e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c","title":"Apache Threading Error","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2019-01-22","modified":"2021-11-27","description":"Detects an issue in apache logs that reports threading related errors","references":["https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md"],"logsource":{"service":"apache"},"tags":["attack.initial-access","attack.lateral-movement","attack.t1190","attack.t1210"],"path":"rules/web/product/apache/web_apache_threading_error.yml","techniques":["T1190","T1210"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-54085","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-0669","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-42013","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-41773","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}