T1210Lateral Movement
Exploitation of Remote Services
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote…
CVEs21
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.21
Reports3
Detections
15 Sigma rules tagged T1210Exploitation of Remote ServicesT121015 general rules
- Zerologon Exploitation Using Well-known Toolscriticalstable
- Audit CVE Eventcriticaltest
- WannaCry Ransomware Activitycriticaltest
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647highstable
- Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoChightest
- Exploitation Attempt Of CVE-2023-46214 Using Public POC Codehightest
- HackTool - SharpWSUS/WSUSpendu Executionhightest
- Possible Exploitation of Exchange RCE CVE-2021-42321hightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Exploitation of Remote Services
21 CVEs, by priority. Each link shows its badge.- CVE-2017-0144Microsoft SMBv1 Remote Code Execution VulnerabilityMicrosoft · SMBv1KEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services3 reportsAI mapping from the description · how it is exploited99.2%Top 0.06%86.9priority
- CVE-2021-42013Apache HTTP Server Path Traversal VulnerabilityApache · HTTP ServerKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services1 reportMITRE CTID mapping of the KEV entry · how it is exploited>99.9%Top 0.02%83.7priority
- CVE-2021-41773Apache HTTP Server Path Traversal VulnerabilityApache · HTTP ServerKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesMITRE CTID mapping of the KEV entry · how it is exploited>99.9%Top 0.01%79.9priority
- CVE-2017-7494Samba Remote Code Execution VulnerabilitySamba · SambaKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited99.4%Top 0.06%79.8priority
- CVE-2020-3992VMware ESXi OpenSLP Use-After-Free VulnerabilityAI mapping from the description · how it is exploited83.0%Top 0.33%79.8priority
- CVE-2017-0145Microsoft SMBv1 Remote Code Execution VulnerabilityMicrosoft · SMBv1KEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited89.8%Top 0.21%79.1priority
- CVE-2017-0146Microsoft Windows SMB Remote Code Execution VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited89.8%Top 0.21%79.1priority
- CVE-2017-0148Microsoft SMBv1 Server Remote Code Execution VulnerabilityMicrosoft · SMBv1 serverKEVRansomwarePublic exploitHigh · 8.1T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited99.4%Top 0.06%78.7priority
- CVE-2023-0669Fortra GoAnywhere MFT Remote Code Execution VulnerabilityFortra · GoAnywhere MFTKEVRansomwarePublic exploitHigh · 7.2T1190Exploit Public-Facing ApplicationT1210Exploitation of Remote Services+1 moreMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.01%78.0priority
- CVE-2018-0171Cisco IOS and IOS XE Software Smart Install Remote Code Execution VulnerabilityCisco · IOS and IOS XEKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services+1 more · 2 reportsAI mapping from the description · how it is exploited99.5%Top 0.06%76.0priority
- CVE-2026-33824Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityMicrosoft · Internet Key Exchange (IKE) Service ExtensionsKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited77.1%Top 0.45%74.8priority
- CVE-2020-2551Oracle Fusion Middleware Unspecified VulnerabilityOracle · Fusion MiddlewareKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1210Exploitation of Remote Services1 reportAI mapping from the description · primary impact92.8%Top 0.17%73.7priority
- CVE-2008-4250Microsoft Windows Buffer Overflow VulnerabilityMicrosoft · WindowsKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesMITRE CTID mapping of the CVE · uncategorised98.8%Top 0.07%69.8priority
- CVE-2024-54085AMI MegaRAC SPx Authentication Bypass by Spoofing VulnerabilityAMI · MegaRAC SPxKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1068Exploitation for Privilege Escalation+3 moreMITRE CTID mapping of the KEV entry · primary impact60.7%Top 0.85%69.7priority
- CVE-2024-37079Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityBroadcom · VMware vCenter ServerKEVCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited22.4%Top 2.3%69.4priority
- CVE-2016-6366Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow VulnerabilityCisco · Adaptive Security Appliance (ASA)KEVPublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited87.6%Top 0.24%69.1priority
- CVE-2020-3118Cisco IOS XR Software Discovery Protocol Format String VulnerabilityCisco · IOS XRKEVPublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited11.7%Top 3.9%68.4priority
- CVE-2019-3568WhatsApp VOIP Stack Buffer Overflow VulnerabilityMeta Platforms · WhatsAppKEVCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesAI mapping from the description · how it is exploited30.1%Top 1.8%64.5priority
- CVE-2018-0167Cisco IOS, XR, and XE Software Buffer Overflow VulnerabilityCisco · IOS, XR, and XE SoftwareKEVHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services+1 moreAI mapping from the description · how it is exploited3.4%Top 11%61.9priority
- CVE-2016-8562Siemens SIMATIC CP 1543-1 Improper Privilege Management VulnerabilitySiemens · SIMATIC CPKEVHigh · 7.5T1210Exploitation of Remote ServicesT1499.004Application or System ExploitationAI mapping from the description · how it is exploited3.6%Top 11%61.1priority
- CVE-2017-6663Cisco IOS Software and Cisco IOS XE Software Denial-of-Service VulnerabilityCisco · IOS and IOS XE SoftwareKEVMedium · 6.5T1210Exploitation of Remote ServicesT1499.004Application or System ExploitationAI mapping from the description · how it is exploited2.1%Top 18%58.9priority
Passages that support these links
Joe Marshall, and Arnaud Zobec.Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos
It spreads to Microsoft Windows machines using several propagation methods, including the EternalBlue exploit for the CVE-2017-0144 vulnerability in the SMB service. This is the same vulnerability Microsoft reported on in MS17-010, which was exploited so successfully in the recent WannaCry ransomware outbreak.
Joe Marshall, and Arnaud Zobec.Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos