CmdID

CmdID / Techniques

T1021 Remote Services

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. MITRE ATT&CK

4 Sigma rules T1021 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1021.001Remote Services: Remote Desktop Protocol
T1021.002Remote Services: SMB/Windows Admin Shares
T1021.003Remote Services: Distributed Component Object Model
T1021.004Remote Services: SSH
T1021.005Remote Services: VNC
T1021.006Remote Services: Windows Remote Management

Sigma rules tagged with it

process creation, the highest levels first
highHackTool - NetExec ExecutionChirag Damani · Windows
highPrivilege Escalation via Named Pipe ImpersonationTim Rauch, Elastic (idea) · Windows
mediumPotential Remote Desktop TunnelingTim Rauch, Elastic (idea) · Windows
mediumPsexec Executionomkar72 · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Execute a command using cmd in a remote shell on the page for psexec

psexec \\remote_host cmdIdentify

Execute a command on a remote host (pre-authenticated) on the page for psexec

psexec \\remote_host -u user_name -p passwordIdentify

Execute a command remotely and output the result to a file on the page for psexec

psexec \\remote_host cmd /c command -an ^>path\to\file.txtIdentify

Execute a program to interact with users on the page for psexec

psexec \\remote_host -d -i program_nameIdentify

Display the IP configuration of the remote host on the page for psexec

psexec \\remote_host ipconfig /allIdentify

An example is here when CmdID’s reading of it names T1021: a Sigma rule it trips is tagged with it, or its abuse is documented as it.