T1021 Remote Services
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- CobaltStrike Service Installations - Systemcriticaltest · windows
- Potential DCOM InternetExplorer.Application DLL Hijackcriticaltest · windows
- Potential DCOM InternetExplorer.Application DLL Hijack - Image Loadcriticaltest · windows
- Turla Group Lateral Movementcriticaltest · windows
- Wmiprvse Wbemcomn DLL Hijack - Filecriticaltest · windows
- HackTool - Potential Impacket Lateral Movement Activityhighstable · windows
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647highstable · zeek
- Remote LSASS Process Access Through Windows Remote Managementhighstable · windows
- CobaltStrike Service Installations - Securityhightest · windows
- DCOM InternetExplorer.Application Iertutil DLL Hijack - Securityhightest · windows
- First Time Seen Remote Named Pipehightest · windows
- First Time Seen Remote Named Pipe - Zeekhightest · zeek
- HackTool - SharpMove Tool Executionhightest · windows
- Hermetic Wiper TG Process Patternshightest · windows
- Impacket PsExec Executionhightest · windows
- MMC Spawning Windows Shellhightest · windows
- MMC20 Lateral Movementhightest · windows
- Metasploit Or Impacket Service Installation Via SMB PsExechightest · windows
- Metasploit SMB Authenticationhightest · windows
- OpenCanary - FTP Login Attempthightest · opencanary
- OpenCanary - SMB File Open Requesthightest · opencanary
- OpenCanary - SNMP OID Requesthightest · opencanary
- OpenCanary - SSH Login Attempthightest · opencanary
- OpenCanary - SSH New Connection Attempthightest · opencanary
- OpenCanary - VNC Connection Attempthightest · opencanary
Mostrando 25 de 87.
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.