Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).[1][2] They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter.
Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer.[3][4][5] Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.[6][7][4]
| ID | Name | Description |
|---|---|---|
| G0143 | Aquatic Panda |
Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.[8] |
| S1063 | Brute Ratel C4 |
Brute Ratel C4 has the ability to use RPC for lateral movement.[9] |
| G1003 | Ember Bear |
Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.[10] |
| S0437 | Kivars |
Kivars has the ability to remotely trigger keyboard input and mouse clicks. [11] |
| S1016 | MacMa | |
| S0603 | Stuxnet |
Stuxnet can propagate via peer-to-peer communication and updates using RPC.[13] |
| G0102 | Wizard Spider |
Wizard Spider has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.[14] |
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. |
| M1042 | Disable or Remove Feature or Program |
If remote services, such as the ability to make direct connections to cloud virtual machines, are not required, disable these connection types where feasible. On ESXi servers, consider enabling lockdown mode, which disables direct access to an ESXi host and requires that the host be managed remotely using vCenter.[15][16] |
| M1035 | Limit Access to Resource Over Network |
Prevent unnecessary remote access to file shares, hypervisors, sensitive systems, etc. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.[17] |
| M1032 | Multi-factor Authentication |
Use multi-factor authentication on remote service logons where possible. |
| M1027 | Password Policies |
Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed. |
| M1018 | User Account Management |
Limit the accounts that may use remote services. Limit the permissions for accounts that are at higher risk of compromise; for example, configure SSH so users can only run specific programs. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0269 | Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity | AN0750 |
Logon via RDP or WMI by a user account followed by uncommon command execution, file manipulation, or lateral network connections. |
| AN0751 |
SSH session from new source IP followed by interactive shell or privilege escalation (e.g., sudo, su) and outbound lateral connection. |
||
| AN0752 |
Remote login via ARD or SSH followed by screensharingd process activity or modification of TCC-protected files. |
||
| AN0753 |
Use of cloud-based bastion or VM console session followed by commands that initiate outbound SSH or RDP sessions from the cloud instance to other environments. |
||
| AN0754 |
vSphere API logins (vimService) or SSH to ESXi host followed by unauthorized shell commands or lateral remote logins from the ESXi host. |