T1133 External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- External Remote SMB Logon from Public IPhightest · windows
- OpenCanary - SSH Login Attempthightest · opencanary
- OpenCanary - SSH New Connection Attempthightest · opencanary
- OpenCanary - Telnet Login Attempthightest · opencanary
- Running Chrome VPN Extensions via the Registry 2 VPN Extensionhightest · windows
- Unusual Child Process of dns.exehightest · windows
- Unusual File Deletion by Dns.exehightest · windows
- Unusual File Modification by dns.exehightest · windows
- User Added to Remote Desktop Users Grouphightest · windows
- OpenCanary - RDP New Connection Attempthighexperimental · opencanary
- Potential Exploitation of GoAnywhere MFT Vulnerabilityhighexperimental · windows
- Suspicious File Created by ArcSOC.exehighexperimental · windows
- External Remote RDP Logon from Public IPmediumtest · windows
- Failed Logon From Public IPmediumtest · windows
- Remote Access Tool - ScreenConnect Installation Executionmediumtest · windows
- FortiGate - New VPN SSL Web Portal Addedmediumexperimental · fortigate
- FortiGate - VPN SSL Settings Modifiedmediumexperimental · fortigate
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.