External Remote Services

From ATT&CK
Jump to: navigation, search
External Remote Services
Technique
ID T1133
Tactic Persistence
Platform Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1
Permissions Required User
Data Sources Authentication logs
Contributors Daniel Oakley

Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services.

Adversaries may use remote services to access and persist within a network.1 Access to Legitimate Credentials to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as part of Redundant Access during an operation.

Examples

  • APT18 actors leverage legitimate credentials to log into external remote services.2
  • Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.3

Mitigation

Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems. Deny direct remote access to internal systems through uses of network proxies, gateways, and firewalls as appropriate. Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of Two-Factor Authentication Interception techniques for some two-factor authentication implementations.

Detection

Follow best practices for detecting adversary use of Legitimate Credentials for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours.