Register to stream ATT&CKcon 2.0 October 29-30

External Remote Services

Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management can also be used externally.

Adversaries may use remote services to initially access and/or persist within a network. [1] Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as part of Redundant Access during an operation.

ID: T1133
Tactic: Persistence, Initial Access
Platform: Windows
Permissions Required: User
Data Sources: Authentication logs
Contributors: Daniel Oakley; Travis Smith, Tripwire
Version: 2.0

Procedure Examples

Name Description
APT18 APT18 actors leverage legitimate credentials to log into external remote services. [3]
Dragonfly 2.0 Dragonfly 2.0 used VPNs and Outlook Web Access (OWA) to maintain access to victim networks. [7] [8]
FIN5 FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment. [9] [10] [11]
Ke3chang Ke3chang regained access after eviction via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host. [6]
Linux Rabbit Linux Rabbit attempts to gain access to the server via SSH. [2]
Night Dragon Night Dragon has used compromised VPN accounts to gain access to victim systems. [12]
OilRig OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment. [4]
Soft Cell Soft Cell established VPN access into victim environments. [14]
TEMP.Veles TEMP.Veles has used a VPN to persist in the victim environment. [13]
Threat Group-3390 Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. [5]

Mitigations

Mitigation Description
Disable or Remove Feature or Program Disable or block remotely available services that may be unnecessary.
Limit Access to Resource Over Network Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.
Multi-factor Authentication Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of Two-Factor Authentication Interception techniques for some two-factor authentication implementations.
Network Segmentation Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Detection

Follow best practices for detecting adversary use of Valid Accounts for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours.

References