T1133
External Remote Services
Containers · Linux · macOS · Windows2 pieces on this siteT1133 on attack.mitre.org
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Edge appliance or VPN compromise
A vendor advisory for a device you run at the perimeter, unexplained admin sessions on it, or an internal alert whose earliest source is the VPN range.
A remote access tool nobody installed
AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop or something like them appears on a host where IT does not use it, or a sanctioned tool connects to an account or relay you do not own.
how MITRE says to see it
Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
- Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.
- Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).
- Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.
- Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.
what reduces it
- M1035 Limit Access to Resource Over Network. Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.
- M1021 Restrict Web-Based Content. Restrict all traffic to and from public Tor nodes.
- M1030 Network Segmentation. Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
- M1032 Multi-factor Authentication. Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of Multi-Factor Authentication Interception techniques for some two-factor authentication implementations.
- M1042 Disable or Remove Feature or Program. Disable or block remotely available services that may be unnecessary.