Remote Services
- ID
- T1021
- Tactics
- TA0008 Lateral Movement
- Platforms
- Linux, macOS, Windows, IaaS, ESXi
- Data sources
- Logon Session Creation, Process Creation, Network Connection Creation, Command Execution
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).[4][5] They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter.
Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer.[6][7][8] Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.[9][10][7]
Sub-techniques (8)
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.003 Distributed Component Object Model
- T1021.004 SSH
- T1021.005 VNC
- T1021.006 Windows Remote Management
- T1021.007 Cloud Services
- T1021.008 Direct Cloud VM Connections
Detection
- DET0269 Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity
Data components: Logon Session Creation, Process Creation, Network Connection Creation, Command Execution
Mitigations (6)
- M1018 User Account Management
Limit the accounts that may use remote services. Limit the permissions for accounts that are at higher risk of compromise; for example, configure SSH so users can only run specific programs.
- M1027 Password Policies
Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed.
- M1032 Multi-factor Authentication
Use multi-factor authentication on remote service logons where possible.
- M1035 Limit Access to Resource Over Network
Prevent unnecessary remote access to file shares, hypervisors, sensitive systems, etc. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.[1]
- M1042 Disable or Remove Feature or Program
If remote services, such as the ability to make direct connections to cloud virtual machines, are not required, disable these connection types where feasible. On ESXi servers, consider enabling lockdown mode, which disables direct access to an ESXi host and requires that the host be managed remotely using vCenter.[2][3]
- M1047 Audit
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Groups (3)
Software (4)
References
- Sygnia ESXi Ransomware 2024
- Google Cloud Threat Intelligence ESXi Hardening 2023
- Broadcom ESXi Lockdown Mode
- SSH Secure Shell
- TechNet Remote Desktop Services
- Remote Management MDM macOS
- Kickstart Apple Remote Desktop commands
- Apple Remote Desktop Admin Guide 3.3
- FireEye 2019 Apple Remote Desktop
- Lockboxx ARD 2019