Techniques › T1133
T1133 External Remote Services
persistence · initial access — Containers, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
20
Sigma rules tagged attack.t1133
25
KEV CVEs mapped here
<p>Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.</p><p>Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as a redundant or persistent access mechanism during an operation.</p><p>Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.</p><p>Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool
ShadowLink to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because ShadowLink sets up a .onion address on the compromised system. ShadowLink may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access. Adversaries may get ShadowLink to persist on a system by masquerading it as an MS Defender application.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2023-39780 | ASUS RT-AX55 Routers | exploitation technique | Mapped | 2025-06-02 |
| CVE-2025-32756 | Fortinet Multiple Products | exploitation technique | Mapped | 2025-05-14 |
| CVE-2024-11120 | GeoVision Multiple Devices | exploitation technique | Mapped | 2025-05-07 |
| CVE-2024-45195 | Apache OFBiz | exploitation technique | Mapped | 2025-02-04 |
| CVE-2023-48365 | Qlik Sense | exploitation technique | Mapped | 2025-01-13 |
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense | exploitation technique | Mapped | 2023-09-13 |
| CVE-2023-27532 | Veeam Backup & Replication | exploitation technique | Mapped | 2023-08-22 |
| CVE-2022-20699 | Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers | exploitation technique | Mapped | 2022-03-03 |
| CVE-2014-6271 | GNU Bourne-Again Shell (Bash) | exploitation technique | Mapped | 2022-01-28 |
| CVE-2014-7169 | GNU Bourne-Again Shell (Bash) | exploitation technique | Mapped | 2022-01-28 |
| CVE-2018-4939 | Adobe ColdFusion | primary impact | Mapped | 2021-11-03 |
| CVE-2019-3396 | Atlassian Confluence Server and Data Server | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-1497 | Cisco HyperFlex HX | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-1498 | Cisco HyperFlex HX | exploitation technique | Mapped | 2021-11-03 |
| CVE-2019-19781 | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | exploitation technique | Mapped | 2021-11-03 |
| CVE-2020-25506 | D-Link DNS-320 Device | exploitation technique | Mapped | 2021-11-03 |
| CVE-2020-8515 | DrayTek Multiple Vigor Routers | exploitation technique | Mapped | 2021-11-03 |
| CVE-2020-5902 | F5 BIG-IP | exploitation technique | Stale | 2021-11-03 |
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management | exploitation technique | Mapped | 2021-11-03 |
| CVE-2019-5591 | Fortinet FortiOS | exploitation technique | Mapped | 2021-11-03 |
| CVE-2019-0708 | Microsoft Remote Desktop Services | exploitation technique | Mapped | 2021-11-03 |
| CVE-2020-1472 | Microsoft Netlogon | exploitation technique secondary impact | Mapped | 2021-11-03 |
| CVE-2021-26855 | Microsoft Exchange Server | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-26857 | Microsoft Exchange Server | secondary impact | Mapped | 2021-11-03 |
| CVE-2019-11510 | Ivanti Pulse Connect Secure | exploitation technique | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers v1.0
AN1004 WindowsUnusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.WinEventLog:Application
VPN, Citrix, or remote access gateway logs showing external IP addresses→ DC0038 Application Log ContentTunable:BusinessHoursKnownRemoteIPsFailedLogonThresholdGeoIPWhitelistTimeWindowAN1005 LinuxRepeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).Tunable:KnownSSHClientsFailedLogonThresholdTimeWindowAN1006 macOSUnexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.macos:unifiedlogRemote login (ssh) or screen sharing authentication attempts→ DC0088 Logon Session MetadataTunable:KnownVNCServersTimeWindowAN1007 ContainersConnections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.ApplicationLog:APIDocker/Kubernetes API access from external sources→ DC0038 Application Log Contentkubernetes:auditUnauthorized container creation or kubelet exec logs→ DC0088 Logon Session MetadataTunable:AllowedCIDRsTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1133
Author: Josh Nickels, Qi Nan
· 2024-03-11 · logsource: product=linux category=process_creation · 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · 2bfb6216-0c31-4d20-8501-2629b29a3fa2
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36
Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e
Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-07 · logsource: product=windows category=process_creation · 6c76b3d0-afe4-4870-9443-ffe6773c5fef
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.
This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Author: Florian Roth (Nextron Systems)
· 2021-02-11 (modified 2024-02-26) · logsource: product=windows category=process_creation · 75bfe6e6-cd8e-429e-91d3-03921e1d7962
Detects ScreenConnect program starts that establish a remote access to a system.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · 8b5dacf2-aeb7-459d-b133-678eb696d410
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Author: Tim Rauch (Nextron Systems), Elastic (idea)
· 2022-09-27 (modified 2023-02-15) · logsource: product=windows category=file_delete · 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0
Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Tim Rauch (Nextron Systems), Elastic (idea)
· 2022-09-27 · logsource: product=windows category=file_change · 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3
Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 (modified 2023-02-05) · logsource: product=windows category=process_creation · a4e3d776-f12e-42c2-8510-9e6ed1f43ec3
Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Josh Nickels, Qi Nan
· 2024-03-11 · logsource: product=windows category=process_creation · ab70c354-d9ac-4e11-bbb6-ec8e3b153357
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Author: frack113
· 2021-12-28 (modified 2023-08-17) · logsource: product=windows category=registry_set · b64a026b-8deb-4c1d-92fd-98893209dff1
Running Chrome VPN Extensions via the Registry install 2 vpn extension
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Author: Micah Babinski
· 2025-11-25 · logsource: product=windows category=file_event · e890acee-d488-420e-8f20-d9b19b3c3d43
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
Author: Josh Nickels, Qi Nan
· 2024-03-11 · logsource: product=macos category=process_creation · f459ccb4-9805-41ea-b5b2-55e279e2424a
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Author: NVISO
· 2020-05-06 (modified 2024-03-11) · logsource: product=windows service=security · f88e112a-21aa-44bd-9b01-6ee2a2bbbed1
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb
Detects instances where an SSH service on an OpenCanary node has had a login attempt.
Author: Florian Roth (Nextron Systems)
· 2021-12-06 (modified 2022-09-09) · logsource: product=windows category=process_creation · ffa28e60-bdb1-46e0-9f82-05f7a61cc06e
Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".