القائمة
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1021-remote-servicesيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | T1021_remote-services |
| description | Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. |
| category | authorization |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1021","lateral-movement","linux","macos","windows","iaas","esxi"] |
| technique_id | T1021 |
| tactic | lateral-movement |
| all_tactics | ["lateral-movement"] |
| platforms | ["Linux","macOS","Windows","IaaS","ESXi"] |
| mitre_url | https://attack.mitre.org/techniques/T1021 |
| tech_stack | ["linux","macos","windows","cloud","esxi"] |
| cwe_ids | ["CWE-284"] |
| chains_with | ["T1021.001","T1021.002","T1021.003","T1021.004","T1021.005","T1021.006","T1021.007","T1021.008"] |
| prerequisites | [] |
| severity_boost | {"T1021.001":"Chain with T1021.001 for deeper attack path","T1021.002":"Chain with T1021.002 for deeper attack path","T1021.003":"Chain with T1021.003 for deeper attack path"} |
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter.
Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.
Platforms: Linux, macOS, Windows, IaaS, ESXi
Identify Attack Surface: Determine if the target environment is susceptible to Remote Services by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1021 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Prevent unnecessary remote access to file shares, hypervisors, sensitive systems, etc. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Limit the accounts that may use remote services. Limit the permissions for accounts that are at higher risk of compromise; for example, configure SSH so users can only run specific programs.
If remote services, such as the ability to make direct connections to cloud virtual machines, are not required, disable these connection types where feasible. On ESXi servers, consider enabling lockdown mode, which disables direct access to an ESXi host and requires that the host be managed remotely using vCenter.
Use multi-factor authentication on remote service logons where possible.
Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed.
| Finding | Severity | Impact |
|---|---|---|
| Remote Services technique applicable | High | Lateral Movement |
| CWE ID | Title |
|---|---|
| CWE-284 | Improper Access Control |
