ATT&CK coverage › Technique

External Remote Services T1133

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Events covered

11 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon2A process changed a file creation time
Sysmon3Network connection
Sysmon11FileCreate
Sysmon13RegistryEvent (Value Set)
Sysmon23FileDelete (File Delete archived)
Sysmon26FileDeleteDetected (File Delete logged)
Security-Auditing4624An account was successfully logged on.
Security-Auditing4625An account failed to log on.
Security-Auditing4688A new process has been created.
TerminalServices-ClientActiveXCore1024RDP ClientActiveX is trying to connect to the server (Value).

Authoring guide

Patterns shared across the 17 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (12 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
TargetFilename6ends_with 3, in 2, eq 1\dns.log, "*\\HttpProxy\\OAB\\*", "*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", .ps1
Image5ends_with 4, eq 1\dns.exe, TeamViewer_Desktop.exe, \ArcSOC.exe, \conhost.exe
src_ip3cidr_match 3, eq 2, match 110.0.0.0/8, -, ::1/128
CommandLine3match 2, ends_with 1&k=, &p=, e=Access&, TeamViewer_Desktop.exe --IPCport 5939 --Module 1, Add-LocalGroupMember
file_name3in 2, eq 1"*.ashx", "*.aspx", "*.asp*"
process_name3in 2, eq 1MSExchangeMailboxReplication.exe, "java.exe", "javaw.exe", "sh.exe", "powershell_ise.exe"
LogonType2eq 210, 3
ParentImage2eq 1, ends_with 1TeamViewer_Service.exe, \dns.exe
TargetObject1match 1, ends_with 1jajilbjjinjmgcibalaakngmkilboobh, eidnihaadmmancegllknfbliaijfmkgo, lcmammnjlbmlbcaniggmlejfjpjagiia
DestinationPort1in 1389, 1099, 636
parent_process_name1in 1"nginx.exe", "httpd", "java.exe"
EventID1eq 11024

Top indicator values (211 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
src_ipcidr_match192.168.0.0/1633
src_ipcidr_match172.16.0.0/1233
src_ipcidr_match::1/12834
src_ipcidr_matchfc00::/734
src_ipcidr_match127.0.0.0/834
src_ipcidr_match169.254.0.0/1634
src_ipcidr_matchfe80::/1034
src_ipcidr_match10.0.0.0/833
src_ipeq-22
Imageends_with\dns.exe22
TargetFilenameends_with\dns.log22
TargetFilenamein"*\\inetpub\\wwwroot\\aspnet_client\\*"22
TargetFilenamein"*\\HttpProxy\\owa\\auth\\*"22
file_namein"*.ashx"24
TargetFilenamein"*\\HttpProxy\\OAB\\*"22
LogonTypeeq1014
LogonTypeeq3112
src_ipmatch-1
CommandLinematche=Access&1
CommandLinematchy=Guest&1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 11 rules

Splunk 6 rules