T1021Lateral Movement
Remote Services
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network.…
CVEs5
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.5
Reports1
Detections
11 Sigma rules tagged T1021Remote ServicesT102111 general rules
- New RDP Connection Initiated From Domain Controllerhightest
- OpenCanary - FTP Login Attempthightest
- OpenCanary - SMB File Open Requesthightest
- OpenCanary - SNMP OID Requesthightest
- OpenCanary - SSH Login Attempthightest
- OpenCanary - SSH New Connection Attempthightest
- OpenCanary - VNC Connection Attempthightest
- Privilege Escalation via Named Pipe Impersonationhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Remote Services
5 CVEs, by priority. Each link shows its badge.- CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reportsMITRE CTID mapping of the KEV entry · primary impact99.4%Top 0.06%86.8priority
- CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityFortinet · FortiOS and FortiProxyKEVRansomwarePublic exploitCritical · 9.8T1078Valid AccountsT1068Exploitation for Privilege Escalation+2 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity94.3%Top 0.15%83.7priority
- CVE-2023-28252Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1078Valid AccountsT1059Command and Scripting Interpreter+5 moreMITRE CTID mapping of the KEV entry · follow-on activity48.9%Top 1.1%78.2priority
- CVE-2026-65400Apple macOS Improper Authentication VulnerabilityAI mapping from the description · primary impact1.7%Top 23%75.4priority
- CVE-2025-54309CrushFTP Unprotected Alternate Channel VulnerabilityCrushFTP · CrushFTPKEVPublic exploitCritical · 9.8T1068Exploitation for Privilege EscalationT1021Remote Services+1 moreMITRE CTID mapping of the KEV entry · follow-on activity93.5%Top 0.16%69.8priority
Linked through a sub-technique
4 more- CVE-2025-32433Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function VulnerabilityErlang · Erlang/OTPKEVPublic exploitCritical · 10.0T1059Command and Scripting InterpreterT1021.004SSH98.9%Top 0.07%80.0priority
- CVE-2015-7755Juniper ScreenOS Improper Authentication Vulnerability61.1%Top 0.84%69.7priority
- CVE-2023-22952Multiple SugarCRM Products Remote Code Execution VulnerabilitySugarCRM · Multiple ProductsKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+7 more80.1%Top 0.38%69.1priority
- CVE-2023-39780ASUS RT-AX55 Routers OS Command Injection Vulnerability39.5%Top 1.4%68.9priority