CmdID

CmdID / Techniques

T1133 External Remote Services

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. MITRE ATT&CK

7 Sigma rules T1133 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first

highPotential Exploitation of GoAnywhere MFT VulnerabilityMSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highUnusual Child Process of dns.exeTim Rauch, Elastic (idea) · Windows

highUser Added to Remote Desktop Users GroupFlorian Roth (Nextron Systems) · Windows

mediumRemote Access Tool - ScreenConnect Installation ExecutionFlorian Roth (Nextron Systems) · Windows

lowRemote Access Tool - Team Viewer Session Started On Linux HostJosh Nickels, Qi Nan · Linux

lowRemote Access Tool - Team Viewer Session Started On MacOS HostJosh Nickels, Qi Nan · macOS

lowRemote Access Tool - Team Viewer Session Started On Windows HostJosh Nickels, Qi Nan · Windows