Techniques › T1210
T1210 Exploitation of Remote Services
lateral movement — Linux, Windows, macOS, ESXi · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
15
Sigma rules tagged attack.t1210
4
KEV CVEs mapped here
<p>Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.</p><p>An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Discovery or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.</p><p>There are several well-known vulnerabilities that exist in common services such as SMB and RDP as well as applications that may be used within internal networks such as MySQL and web server services. Additionally, there have been a number of vulnerabilities in VMware vCenter installations, which may enable threat actors to move laterally from the compromised vCenter server to virtual machines or even to ESXi hypervisors.</p><p>Depending on the permissions level of the vulnerable remote service an adversary may achieve Exploitation for Privilege Escalation as a result of lateral movement exploitation as well.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-54085 | AMI MegaRAC SPx | primary impact | Mapped | 2025-06-25 |
| CVE-2023-0669 | Fortra GoAnywhere MFT | primary impact | Mapped | 2023-02-10 |
| CVE-2021-42013 | Apache HTTP Server | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-41773 | Apache HTTP Server | exploitation technique | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0118 Exploitation of Remote Services – multi-platform lateral movement detection v1.0
AN0327 WindowsCorrelates inbound network access to remote service ports (e.g., SMB/RPC 445/135, RDP 3389, WinRM 5985/5986) with near-time instability in the target service (crash, abnormal restart), suspicious child process creation under the service, and post-access lateral-movement behaviors. The chain indicates likely exploitation rather than normal administration.NSM:Flow
Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval.→ DC0085 Network Traffic ContentTunable:ServicePortSetTimeWindowAllowedAdminCIDRsMinConnErrorRateAN0328 LinuxLinks inbound network access to SSHD/SMB/NFS/Databases or custom daemons with subsequent daemon crash/restart, core dump, or spawning of shells/reverse shells from the service context, indicating remote exploitation.linux:syslogkernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc.→ DC0038 Application Log Contentauditd:SYSCALLexecve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity.→ DC0032 Process CreationNSM:FlowInbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host.→ DC0085 Network Traffic ContentTunable:ServiceNamesCoreDumpPathsShellSpawnAllowlistTimeWindowAN0329 ESXiDetects exploitation targeting ESXi/vCenter by correlating attempts to reach known exploitable endpoints (OpenSLP 427, CIM 5989, Hostd/Vpxa HTTPS 443, ESXi SOAP) with vmkernel/hostd crashes, unexpected hostd/vpxa restarts, or new reverse/outbound connections from ESXi host/vCenter to internal assets.esxi:hostdKeywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log.→ DC0038 Application Log ContentNSM:FlowInbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host.→ DC0085 Network Traffic ContentTunable:ESXiServicePortsMgmtCIDRsRestartKeywordsAN0330 macOSTies inbound access to exposed services (ARD/VNC 5900, SSH 22, ScreenSharing, web services) with process crashes in unified logs and abnormal child processes spawned under those services (e.g., bash, curl) to indicate exploitation.macos:unifiedlogprocess 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons.→ DC0038 Application Log Contentmacos:osqueryparent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes.→ DC0032 Process CreationNSM:FlowInbound to 22/5900/8080 and follow-on internal connections.→ DC0085 Network Traffic ContentTunable:ServicePortSetAllowedAdminsTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1210
Author: Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)
· 2023-11-27 · logsource: category=webserver · 04017cd5-621e-4ec4-a762-1f042fe3d3e5
Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing
Author: Florian Roth (Nextron Systems)
· 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community
· 2020-10-13 (modified 2021-05-30) · logsource: product=windows service=system · 18f37338-b9bd-4117-a039-280c81f7a596
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
· 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079
Detects WannaCry ransomware activity
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Florian Roth (Nextron Systems)
· 2022-08-26 · logsource: product=windows category=process_creation · 60bfeac3-0d35-4302-8efb-1dd16f715bc6
Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)
Author: Florian Roth (Nextron Systems), Adam Bradbury (idea)
· 2019-06-02 (modified 2022-12-25) · logsource: product=windows service=security · 8400629e-79a9-4737-b387-5db940ab2367
Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep
Author: Muhammad Faisal (@faisalusuf)
· 2024-12-19 · logsource: product=windows category=dns_query · 882e858a-3233-4ba8-855e-2f3d3575803d
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Author: Lionel PRAT, Christophe BROCAS, @atc_project (improvements)
· 2019-05-24 (modified 2022-12-25) · logsource: product=windows service=system · aaa5b30d-f418-420b-83a0-299cb6024885
Detect suspicious error on protocol RDP, potential CVE-2019-0708
Author: Nate Guagenti (neu5ron)
· 2021-09-20 (modified 2025-11-03) · logsource: product=zeek service=http · ab6b1a39-a9ee-4ab4-b075-e83acf6e346b
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request.
Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP).
Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Author: @Kostastsale, Nasreddine Bencherchali (Nextron Systems)
· 2022-10-07 (modified 2024-08-23) · logsource: product=windows category=process_creation · b0ce780f-10bd-496d-9067-066d23dc3aa5
Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.
Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.
Author: Lars B. P. Frydenskov(Trifork Security)
· 2023-11-27 · logsource: category=webserver · ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code
Author: Florian Roth (Nextron Systems), @testanull
· 2021-11-18 (modified 2022-07-12) · logsource: product=windows service=msexchange-management · c92f1896-d1d2-43c3-92d5-7a5b35c217bb
Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321
Author: @Kostastsale, TheDFIRReport
· 2022-02-12 · logsource: product=windows category=process_creation · dcc6a01e-9471-44a0-a699-71ea96f8ed8b
Detects the execution of the commonly used ZeroLogon PoC executable.
Author: Florian Roth (Nextron Systems)
· 2019-01-22 (modified 2021-11-27) · logsource: service=apache · e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
Detects an issue in apache logs that reports threading related errors