T1210 Exploitation of Remote Services
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Zerologon Exploitation Using Well-known Toolscriticalstable · windows
- Audit CVE Eventcriticaltest · windows
- WannaCry Ransomware Activitycriticaltest · windows
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647highstable · zeek
- Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoChightest · windows
- Exploitation Attempt Of CVE-2023-46214 Using Public POC Codehightest · webserver
- HackTool - SharpWSUS/WSUSpendu Executionhightest · windows
- Possible Exploitation of Exchange RCE CVE-2021-42321hightest · windows
- Scanner PoC for CVE-2019-0708 RDP RCE Vulnhightest · windows
- Terminal Service Process Spawnhightest · windows
- Apache Threading Errormediumtest · apache
- Potential CVE-2023-46214 Exploitation Attemptmediumtest · webserver
- Potential RDP Exploit CVE-2019-0708mediumtest · windows
- Suspicious SysAidServer Childmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.