| name | T0886_remote-services |
| description | Adversaries may leverage remote services to move between assets and network segments. |
| category | input-validation |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","ics","t0886","initial-access","lateral-movement"] |
| technique_id | T0886 |
| tactic | initial-access |
| all_tactics | ["initial-access","lateral-movement"] |
| platforms | ["ICS"] |
| mitre_url | https://attack.mitre.org/techniques/T0886 |
| tech_stack | ["ics"] |
| cwe_ids | ["CWE-20"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T0886 Remote Services
High-Level Description
Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms.
Remote services could be used to support remote access, data transmission, authentication, name resolution, and other remote functions. Further, remote services may be necessary to allow operators and administrators to configure systems within the network from their engineering or management workstations. An adversary may use this technique to access devices which may be dual-homed to multiple network segments, and can be used for Program Download or to execute attacks on control devices directly through Valid Accounts.
Specific remote services (RDP & VNC) may be a precursor to enable Graphical User Interface execution on devices such as HMIs or engineering workstation software.
Based on incident data, CISA and FBI assessed that Chinese state-sponsored actors also compromised various authorized remote access channels, including systems designed to transfer data and/or allow access between corporate and ICS networks.
Kill Chain Phase
- Initial Access (TA0108)
- Lateral Movement (TA0109)
Platforms: ICS
What to Check
How to Test
Identify Attack Surface
Determine if the target ICS/SCADA environment is susceptible to Remote Services by examining operational technology systems and network architecture.
Assess Existing Defenses
Review whether mitigations for T0886 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Remediation Guide
M0813 Software Process and Device Authentication
All communication sessions to remote services should be authenticated to prevent unauthorized access.
M0800 Authorization Enforcement
Provide privileges corresponding to the restriction of a GUI session to control system operations (examples include HMI read-only vs. read-write modes). Ensure local users, such as operators and engineers, are giving prioritization over remote sessions and have the authority to regain control over a remote session if needed. Prevent remote access sessions (e.g., RDP, VNC) from taking over local sessions, especially those used for ICS control, especially HMIs.
