External Remote Services `T1133`

Tactics: Persistence, Initial Access

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Events covered

20 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 2	A process changed a file creation time
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4778	A session was reconnected to a Window Station.
Security-Auditing	Event ID 4779	A session was disconnected from a Window Station.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
ESF	exec	Process Execution
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
TerminalServices-ClientActiveXCore	Event ID 1024	RDP ClientActiveX is trying to connect to the server (Value).
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 223 rules share fields, values, and exclusions.

Fields filtered most (207 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	22	`eq` 10, `contains` 5, `in` 5, `cross_field_compare` 3, `starts_with` 1	`type`, `authorizesecuritygroupingress`, `login to sra`, `login-success`, `ssh_login`
`HttpRequestMethod`	16	`eq` 10, `in` 8, `contains` 1	`get`, `post`, `put`, `head`, `options`
`data_stream.dataset`	16	`eq` 15, `in` 2	`aws.cloudtrail`, `network_traffic.flow`, `sonicwall_firewall.log`, `fortinet_fortigate.log`, `gcp.audit`
`c-uri`	15	`contains` 11, `in` 5, `eq` 1	`${`, `%2f%7b`, `.jsp?cmd=`, `/app?service=direct/1/printerdetails/printeroptionstab.tab`, `/app?service=direct/1/printerlist/selectprinter&sp=*`
`EventID`	12	`eq` 11, `in` 1	`4688`, `4778`, `4779`, `5156`, `1024`
`Status`	11	`eq` 11	`open`, `FAILED`
`cs-method`	11	`eq` 9, `in` 2	`get`, `post`, `head`, `put`
`src_ip`	11	`is_not_null` 5, `cidr_match` 4, `eq` 3, `contains` 1, `cross_field_compare` 1, `ne` 1	`10.0.0.0/8`, `127.0.0.0/8`, `-`, `0.0.0.0`, `127.0.0.1`
`HttpStatusCode`	10	`ge` 9, `le` 9, `eq` 1	`500`, `400`, `499`, `599`, `100`
`HttpUserAgentOriginal`	10	`contains` 5, `is_not_null` 4, `is_null` 2	`.nasl`, `(bot for jce)`, `(hydra)`, `advanced email extractor`, `360spider`
`process_name`	10	`eq` 5, `in` 4, `regex_match` 1	`java.exe`, `cmd.exe`, `javaw.exe`, `(?i)rdpclip.exe`, `(?i)tstheme.exe`
`DestinationPort`	9	`eq` 4, `in` 2, `regex_match` 2, `ge` 1, `le` 1	`(?i)3389\|rdp`, `1099`, `11434`, `135`, `1389`
`UrlOriginal`	9	`contains` 6, `regex_match` 3, `eq` 1, `is_not_null` 1	`%26%20%64%69%72`, `%26%64%69%72`, `%2f%62%69%6e%2f%62%61%73%68`, `(10\.\d{1,3}\.\d{1,3}\.\d{1,3})\|(172\.1[6-9]\.\d{1,3}\.\d...`, `/%2e%2e/`
`event.category`	9	`in` 5, `eq` 4	`network`, `network_traffic`, `authentication`, `process`
`CommandLine`	8	`contains` 4, `ends_with` 3, `regex_match` 1, `wildcard` 1	`/TeamViewer_Desktop --IPCport 5939 --Module 1`, `-group` , `/add`, `&c=`, `&k=`

Top indicator values (983 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`HttpRequestMethod`	`eq`	`get` kustoApache - Apache 2.4.49 flaw CVE-2021-41773 kustoCloudflare - Multiple error requests from single source kustoCloudflare - Multiple error requests from single source kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected URI kustoCloudflare - Unexpected URI kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoTomcat - Put file and get file from same IP address	10	12
`HttpRequestMethod`	`in`	`post` kustoApache - Put suspicious file kustoCloudflare - XSS probing pattern in request kustoCloudflare - XSS probing pattern in request kustoImperva - Forbidden HTTP request method in request kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoOracle - Put suspicious file kustoTomcat - Put file and get file from same IP address	8	12
`HttpRequestMethod`	`in`	`put` kustoApache - Put suspicious file kustoCloudflare - XSS probing pattern in request kustoCloudflare - XSS probing pattern in request kustoImperva - Forbidden HTTP request method in request kustoNGINX - Put file and get file from same IP address kustoOracle - Put file and get file from same IP address kustoOracle - Put suspicious file kustoTomcat - Put file and get file from same IP address	8	12
`event.outcome`	`eq`	`success` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function URL Created with Public Access elasticAWS RDS DB Instance Made Public elasticGKE Exposed Service Created With Type NodePort elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added elasticSuccessful SSH Authentication from Unusual SSH Public Key elasticSuccessful SSH Authentication from Unusual User	8	375
`Reason`	`eq`	`new_alert` kustoPalo Alto Prisma Cloud - High risk score alert kustoPalo Alto Prisma Cloud - High severity alert opened for several days kustoPalo Alto Prisma Cloud - Maximum risk score alert kustoPalo Alto Prisma Cloud - Network ACL allow all outbound traffic kustoPalo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports kustoPalo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic	6	8
`Status`	`eq`	`open` kustoPalo Alto Prisma Cloud - High risk score alert kustoPalo Alto Prisma Cloud - High severity alert opened for several days kustoPalo Alto Prisma Cloud - Maximum risk score alert kustoPalo Alto Prisma Cloud - Network ACL allow all outbound traffic kustoPalo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports kustoPalo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic	6	9
`Status`	`eq`	`FAILED` kustoSailPointIdentityNowEventType kustoSailPointIdentityNowEventTypeTechnicalName kustoSailPointIdentityNowFailedEvents kustoSailPointIdentityNowFailedEventsBasedOnTime kustoSailPointIdentityNowUserWithFailedEvent	5	5
`EventResourceId`	`eq`	`traffic` kustoPaloAlto - Dropping or denying session with traffic kustoPaloAlto - Forbidden countries kustoPaloAlto - Inbound connection to high risk ports kustoPaloAlto - MAC address conflict kustoPaloAlto - Possible flooding	5	6
`HttpStatusCode`	`ge`	`500` kustoApache - Multiple server errors from single IP kustoNGINX - Multiple server errors from single IP address kustoOracle - Multiple server errors from single IP kustoTomcat - Multiple server errors from single IP address kustoTomcat - Server errors after multiple requests from same IP	5	5
`HttpStatusCode`	`ge`	`400` kustoApache - Multiple client errors from single IP kustoNGINX - Multiple client errors from single IP address kustoOracle - Multiple client errors from single IP kustoTomcat - Multiple client errors from single IP address	4	4
`HttpStatusCode`	`le`	`599` kustoApache - Multiple server errors from single IP kustoNGINX - Multiple server errors from single IP address kustoOracle - Multiple server errors from single IP kustoTomcat - Multiple server errors from single IP address kustoTomcat - Server errors after multiple requests from same IP	5	5
`HttpStatusCode`	`le`	`499` kustoApache - Multiple client errors from single IP kustoNGINX - Multiple client errors from single IP address kustoOracle - Multiple client errors from single IP kustoTomcat - Multiple client errors from single IP address	4	4
`HttpUserAgentOriginal`	`contains`	`havij` kustoApache - Known malicious user agent kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	5	5
`HttpUserAgentOriginal`	`contains`	`nikto` kustoApache - Known malicious user agent kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	5	5
`HttpUserAgentOriginal`	`contains`	`advanced email extractor` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`bfac` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`brutus` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`cgichk` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`cisco-torch` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`datacha0s` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`dirbuster` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	6
`HttpUserAgentOriginal`	`contains`	`fantombrowser` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`HttpUserAgentOriginal`	`contains`	`fantomcrew` kustoImperva - Malicious user agent kustoNGINX - Known malicious user agent kustoOracle - Malicious user agent kustoTomcat - Known malicious user agent	4	4
`UrlOriginal`	`contains`	`whoami` kustoApache - Command in URI kustoApexOne - Commands in Url kustoNGINX - Command in URI kustoOracle - Command in URI kustoTomcat - Commands in URI	5	5
`cs-method`	`eq`	`get` splunkDetect attackers scanning for vulnerable JBoss servers splunkSpring4Shell Payload URL Request splunkVMware Server Side Template Injection Hunt splunkVMware Workspace ONE Freemarker Server-side Template Injection splunkWeb JSP Request via URL	5	49
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function URL Created with Public Access elasticAWS RDS DB Instance Made Public elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	5	173
`event.category`	`in`	`network` elasticAccepted Default Telnet Port Connection elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	5	17
`event.category`	`in`	`network_traffic` elasticAccepted Default Telnet Port Connection elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	5	15
`DstBytes`	`ne`	`0` kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected client request kustoCloudflare - Unexpected URI kustoCloudflare - Unexpected URI	4	6
`DvcAction`	`eq`	`open` kustoZscaler - Forbidden countries kustoZscaler - Shared ZPA session kustoZscaler - Unexpected ZPA session duration kustoZscaler - ZPA connections outside operational hours	4	4

Exclusions (159 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`src_ip`	`cidr_match`	`10.0.0.0/8` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`127.0.0.0/8` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`169.254.0.0/16` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`172.16.0.0/12` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`192.168.0.0/16` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network kustoImperva - Request from unexpected IP address to admin panel kustoOracleDBAudit - Connection to database from external IP kustoPaloAlto - Inbound connection to high risk ports kustoUbiquiti - RDP from external source kustoUbiquiti - SSH from external source	9
`src_ip`	`cidr_match`	`fc00::/7` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network	4
`src_ip`	`cidr_match`	`fe80::/10` sigmaExternal Remote RDP Logon from Public IP sigmaExternal Remote SMB Logon from Public IP sigmaFailed Logon From Public IP elasticOllama API Accessed from External Network	4
`aws::userAgent`	`contains`	`pulumi` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function URL Created with Public Access elasticAWS RDS DB Instance Made Public elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	5
`aws::userAgent`	`contains`	`terraform` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function URL Created with Public Access elasticAWS RDS DB Instance Made Public elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	5
`src_ip`	`in`	`10.0.0.0/8` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`100.64.0.0/10` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`127.0.0.0/8` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`169.254.0.0/16` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`172.16.0.0/12` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4
`src_ip`	`in`	`192.0.0.0/24` elasticRDP (Remote Desktop Protocol) from the Internet elasticRPC (Remote Procedure Call) from the Internet elasticSMB (Windows File Sharing) Activity from the Internet elasticVNC (Virtual Network Computing) from the Internet	4

External Remote Services `T1133`

Events covered

Authoring guide

Fields filtered most (207 distinct)

Top indicator values (983 distinct)

Exclusions (159 distinct)

Rules under this technique

Sigma 20 rules

Elastic 23 rules

Splunk 44 rules

Kusto 132 rules

Panther 4 rules

External Remote Services T1133

Events covered

Authoring guide

Fields filtered most (207 distinct)

Top indicator values (983 distinct)

Exclusions (159 distinct)

Rules under this technique

Sigma 20 rules

Elastic 23 rules

Splunk 44 rules

Kusto 132 rules

Panther 4 rules

External Remote Services `T1133`