{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1133","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"dfc2e4bf2eec3bd089229ef135eb8caf7e515f813f1e3677660cbbe4e7fbdd4a","description":"Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop)\n\nAccess to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.\n\nAccess may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware)\n\nAdversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool `ShadowLink` to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because `ShadowLink` sets up a .onion address on the compromised system. `ShadowLink` may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access.(Citation: The BadPilot campaign) Adversaries may get `ShadowLink` to persist on a system by masquerading it as an MS Defender application.(Citation: Russian threat actors dig in, prepare to seize on war fatigue)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1133","external_id":"T1133"},{"source_name":"Volexity Virtual Private Keylogging","description":"Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017.","url":"https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/"},{"source_name":"MacOS VNC software for Remote Desktop","description":"Apple Support. (n.d.). Set up a computer running VNC software for Remote Desktop. Retrieved August 18, 2021.","url":"https://support.apple.com/guide/remote-desktop/set-up-a-computer-running-vnc-software-apdbed09830/mac"},{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"},{"source_name":"Russian threat actors dig in, prepare to seize on war fatigue","description":"Microsoft Threat Intelligence. (2023, December 7). Russian threat actors dig in, prepare to seize on war fatigue. Retrieved June 18, 2025.","url":"https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/russian-threat-actors-dig-in-prepare-to-seize-on-war-fatigue"},{"source_name":"The BadPilot campaign","description":"Microsoft Threat Intelligence. (2025, February 12). The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation. Retrieved June 18, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/?ref=thestack.technology"},{"source_name":"Trend Micro Exposed Docker Server","description":"Remillano II, A., et al. (2020, June 20). XORDDoS, Kaiji Variants Target Exposed Docker Servers. Retrieved April 5, 2021.","url":"https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html"}],"platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","domain":"enterprise","platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"source_url":"https://attack.mitre.org/techniques/T1133","technique_page":"techniques/enterprise/T1133/","page":"detections/enterprise/T1133/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"598290cf-5932-45cd-9123-be1e05ab4f2e","title":"OpenCanary - RDP New Connection Attempt","status":"experimental","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/598290cf-5932-45cd-9123-be1e05ab4f2e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_rdp_connection_attempt.yml","author":"Marco Pedrinazzi (@pedrinazziM)","kind":"sigma"},{"id":"ff7139bc-fdb1-4437-92f2-6afefe8884cb","title":"OpenCanary - SSH Login Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/ff7139bc-fdb1-4437-92f2-6afefe8884cb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_ssh_login_attempt.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"cd55f721-5623-4663-bd9b-5229cab5237d","title":"OpenCanary - SSH New Connection Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/cd55f721-5623-4663-bd9b-5229cab5237d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_ssh_new_connection.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"512cff7a-683a-43ad-afe0-dd398e872f36","title":"OpenCanary - Telnet Login Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/512cff7a-683a-43ad-afe0-dd398e872f36.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_telnet_login_attempt.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d","title":"Remote Access Tool - Team Viewer Session Started On Linux Host","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml","author":"Josh Nickels, Qi Nan","kind":"sigma"},{"id":"f459ccb4-9805-41ea-b5b2-55e279e2424a","title":"Remote Access Tool - Team Viewer Session Started On MacOS Host","status":"test","level":"low","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/f459ccb4-9805-41ea-b5b2-55e279e2424a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml","author":"Josh Nickels, Qi Nan","kind":"sigma"},{"id":"2bfb6216-0c31-4d20-8501-2629b29a3fa2","title":"FortiGate - New VPN SSL Web Portal Added","status":"experimental","level":"medium","logsource":{"product":"fortigate","service":"event"},"data_path":"data/detection-rules/2bfb6216-0c31-4d20-8501-2629b29a3fa2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml","author":"Marco Pedrinazzi @pedrinazziM (InTheCyber)","kind":"sigma"},{"id":"8b5dacf2-aeb7-459d-b133-678eb696d410","title":"FortiGate - VPN SSL Settings Modified","status":"experimental","level":"medium","logsource":{"product":"fortigate","service":"event"},"data_path":"data/detection-rules/8b5dacf2-aeb7-459d-b133-678eb696d410.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml","author":"Marco Pedrinazzi @pedrinazziM (InTheCyber)","kind":"sigma"},{"id":"259a9cdf-c4dd-4fa2-b243-2269e5ab18a2","title":"External Remote RDP Logon from Public IP","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/259a9cdf-c4dd-4fa2-b243-2269e5ab18a2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml","author":"Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)","kind":"sigma"},{"id":"78d5cab4-557e-454f-9fb9-a222bd0d5edc","title":"External Remote SMB Logon from Public IP","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/78d5cab4-557e-454f-9fb9-a222bd0d5edc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml","author":"Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)","kind":"sigma"},{"id":"f88e112a-21aa-44bd-9b01-6ee2a2bbbed1","title":"Failed Logon From Public IP","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/f88e112a-21aa-44bd-9b01-6ee2a2bbbed1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml","author":"NVISO","kind":"sigma"},{"id":"9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3","title":"Unusual File Modification by dns.exe","status":"test","level":"high","logsource":{"category":"file_change","product":"windows"},"data_path":"data/detection-rules/9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml","author":"Tim Rauch (Nextron Systems), Elastic (idea)","kind":"sigma"},{"id":"8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0","title":"Unusual File Deletion by Dns.exe","status":"test","level":"high","logsource":{"category":"file_delete","product":"windows"},"data_path":"data/detection-rules/8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml","author":"Tim Rauch (Nextron Systems), Elastic (idea)","kind":"sigma"},{"id":"e890acee-d488-420e-8f20-d9b19b3c3d43","title":"Suspicious File Created by ArcSOC.exe","status":"experimental","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/e890acee-d488-420e-8f20-d9b19b3c3d43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml","author":"Micah Babinski","kind":"sigma"},{"id":"a4e3d776-f12e-42c2-8510-9e6ed1f43ec3","title":"Unusual Child Process of dns.exe","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a4e3d776-f12e-42c2-8510-9e6ed1f43ec3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dns_susp_child_process.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"75bfe6e6-cd8e-429e-91d3-03921e1d7962","title":"Remote Access Tool - ScreenConnect Installation Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/75bfe6e6-cd8e-429e-91d3-03921e1d7962.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"ab70c354-d9ac-4e11-bbb6-ec8e3b153357","title":"Remote Access Tool - Team Viewer Session Started On Windows Host","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ab70c354-d9ac-4e11-bbb6-ec8e3b153357.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml","author":"Josh Nickels, Qi Nan","kind":"sigma"},{"id":"ffa28e60-bdb1-46e0-9f82-05f7a61cc06e","title":"User Added to Remote Desktop Users Group","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ffa28e60-bdb1-46e0-9f82-05f7a61cc06e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop_group.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"b64a026b-8deb-4c1d-92fd-98893209dff1","title":"Running Chrome VPN Extensions via the Registry 2 VPN Extension","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/b64a026b-8deb-4c1d-92fd-98893209dff1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_chrome_extension.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1133-1","technique_id":"T1133","title":"T1133 External Remote Services","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#initial-access","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":47,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L47","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"c24a7c43b4a647c72b1c2b763addff2063c8694a29d828bf33a8edf79b9ca63c","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(successful_remote_access) AND source_ip NOT_IN approved_networks -> ALERT","log_sources":[{"title":"Remote Access and VPN Authentication Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#48-remote-access-and-vpn-authentication-logs"},{"title":"Remote Desktop and Remote Support Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#169-remote-desktop-and-remote-support-logs"},{"title":"Network Firewall Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#52-network-firewall-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1133-1","technique_id":"T1133","title":"External remote-service session — T1133 External Remote Services","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#external-remote-session","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":36,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L36","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"84b9e9083c3673f4b14fd561dfdd50197369ba9179eb7f94502a528158547394","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"user-device-service relationship.","expected_behavior":"remote access follows established source, device, and destination relationships.","deviation":"a new edge, unusual session duration, or access outside the entity's temporal context.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Duration Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#18-duration-anomaly"},{"title":"Temporal-Context Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#21-temporal-context-anomaly"}],"log_sources":[{"title":"Remote Access and VPN Authentication Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#48-remote-access-and-vpn-authentication-logs"},{"title":"Remote Desktop and Remote Support Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#169-remote-desktop-and-remote-support-logs"}],"context_references":[{"title":"Play ransomware joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-352a-play-ransomware.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231218.pdf"}]}],"anomaly_types":[{"title":"Duration Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#18-duration-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Temporal-Context Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#21-temporal-context-anomaly"}],"strategies":[{"id":"DET0354","name":"Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers","url":"https://attack.mitre.org/detectionstrategies/DET0354","stix_id":"x-mitre-detection-strategy--e9833c3c-b5ec-421b-bab4-91f74c2b6bd1","relationship_id":"relationship--0b58aa79-627a-4d83-84ab-fb924e5f77e1","description":"","analytics":[{"id":"AN1004","name":"Analytic 1004","guidance":"Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.","url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1004","platforms":["Windows"],"tuning":[{"field":"BusinessHours","description":"Normal business hours for logon activity."},{"field":"KnownRemoteIPs","description":"List of approved external IPs or VPN endpoints."},{"field":"FailedLogonThreshold","description":"Number of failed logons before raising suspicion (e.g., >5)."},{"field":"GeoIPWhitelist","description":"Geographic regions allowed for remote access."},{"field":"TimeWindow","description":"Time window to correlate failed attempts and success (e.g., 15m)."}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"WinEventLog:Security","channel":"EventCode=4776, 4625","platforms":["Windows"],"analytic_id":"AN1004","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1004","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0038","component":"Application Log Content","name":"WinEventLog:Application","channel":"VPN, Citrix, or remote access gateway logs showing external IP addresses","platforms":["Windows"],"analytic_id":"AN1004","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1004","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1004","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1004","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1005","name":"Analytic 1005","guidance":"Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).","url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1005","platforms":["Linux"],"tuning":[{"field":"KnownSSHClients","description":"Legitimate IPs or client fingerprints for SSH/VPN."},{"field":"FailedLogonThreshold","description":"Number of failed SSH logins to trigger alert."},{"field":"TimeWindow","description":"Correlation window for failed attempts and success."}],"log_sources":[{"component_id":"DC0088","component":"Logon Session Metadata","name":"auditd:SYSCALL","channel":"ssh logins or execve of remote commands","platforms":["Linux"],"analytic_id":"AN1005","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1005","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0038","component":"Application Log Content","name":"NSM:Connections","channel":"Failed password or accepted password for SSH users","platforms":["Linux"],"analytic_id":"AN1005","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1005","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"connection: Inbound connections to SSH or VPN ports","platforms":["Linux"],"analytic_id":"AN1005","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1005","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1006","name":"Analytic 1006","guidance":"Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.","url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1006","platforms":["macOS"],"tuning":[{"field":"KnownVNCServers","description":"List of approved VNC/SSH sources."},{"field":"TimeWindow","description":"Time correlation between failed attempts and success."}],"log_sources":[{"component_id":"DC0088","component":"Logon Session Metadata","name":"macos:unifiedlog","channel":"Remote login (ssh) or screen sharing authentication attempts","platforms":["macOS"],"analytic_id":"AN1006","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1006","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"macos:unifiedlog","channel":"Inbound connections to VNC/SSH ports","platforms":["macOS"],"analytic_id":"AN1006","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1006","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"PF:Logs","channel":"External traffic to remote access services","platforms":["macOS"],"analytic_id":"AN1006","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1006","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1007","name":"Analytic 1007","guidance":"Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.","url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1007","platforms":["Containers"],"tuning":[{"field":"AllowedCIDRs","description":"Approved external IP ranges for container APIs."},{"field":"TimeWindow","description":"Correlation window for API calls and container starts."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"ApplicationLog:API","channel":"Docker/Kubernetes API access from external sources","platforms":["Containers"],"analytic_id":"AN1007","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1007","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"kubernetes:audit","channel":"Unauthorized container creation or kubelet exec logs","platforms":["Containers"],"analytic_id":"AN1007","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1007","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"External access to container ports (2375, 6443)","platforms":["Containers"],"analytic_id":"AN1007","source_url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1007","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0362","name":"Linux Rabbit","url":"https://attack.mitre.org/software/S0362","kind":"malware","description":"[Linux Rabbit](https://attack.mitre.org/software/S0362) attempts to gain access to the server via SSH.(Citation: Anomali Linux Rabbit 2018)","relationship_id":"relationship--1f8572d0-007f-4efd-8caa-58ea88849cd1","references":[{"source_name":"Anomali Linux Rabbit 2018","description":"Anomali Labs. (2018, December 6). Pulling Linux Rabbit/Rabbot Malware Out of a Hat. Retrieved March 4, 2019.","url":"https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat"}]},{"id":"S0599","name":"Kinsing","url":"https://attack.mitre.org/software/S0599","kind":"malware","description":"[Kinsing](https://attack.mitre.org/software/S0599) was executed in an Ubuntu container deployed via an open Docker daemon API.(Citation: Aqua Kinsing April 2020)","relationship_id":"relationship--b4728dde-0d7b-4650-910d-4778a07cbfa0","references":[{"source_name":"Aqua Kinsing April 2020","description":"Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}]},{"id":"S0600","name":"Doki","url":"https://attack.mitre.org/software/S0600","kind":"malware","description":"[Doki](https://attack.mitre.org/software/S0600) was executed through an open Docker daemon API port.(Citation: Intezer Doki July 20)","relationship_id":"relationship--eef34338-cf9a-4ba9-986d-f4d49a9d110a","references":[{"source_name":"Intezer Doki July 20","description":"Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) was executed through an unsecure kubelet that allowed anonymous access to the victim environment.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--4c595f86-f839-44a3-81c8-8a1cab9f4293","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can establish an SSH connection from a compromised host to a server.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--2b7c7d72-1858-4e36-a96b-6377272daf70","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) has gained access through VPNs including with compromised accounts and stolen VPN certificates.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--60069193-4573-420f-9b2e-e9a42b95af12","references":[{"source_name":"NCC Group APT15 Alive and Strong","description":"Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used [Tor](https://attack.mitre.org/software/S0183) and a variety of commercial VPN services to route brute force authentication attempts.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)","relationship_id":"relationship--d811c17d-5ed4-4218-b1c9-280e332e30e2","references":[{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","description":"NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) has used compromised identities to access networks via VPNs and Citrix.(Citation: NCSC APT29 July 2020)(Citation: Mandiant APT29 Microsoft 365 2022)","relationship_id":"relationship--8bc0dbc4-f84b-448a-95f9-f6b0ae56f256","references":[{"source_name":"Mandiant APT29 Microsoft 365 2022","description":"Douglas Bienstock. (2022, August 18). You Can’t Audit Me: APT29 Continues Targeting Microsoft 365. Retrieved February 23, 2023.","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source_name":"NCSC APT29 July 2020","description":"National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"}]},{"id":"G0026","name":"APT18","url":"https://attack.mitre.org/groups/G0026","kind":"intrusion-set","description":"[APT18](https://attack.mitre.org/groups/G0026) actors leverage legitimate credentials to log into external remote services.(Citation: RSA2017 Detect and Respond Adair)","relationship_id":"relationship--3b521f87-a77d-4c8d-8ab8-ffc6dbc3d62e","references":[{"source_name":"RSA2017 Detect and Respond Adair","description":"Adair, S. (2017, February 17). Detecting and Responding to Advanced Threats within Exchange Environments. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210803040540/https://published-prd.lanyonevents.com/published/rsaus17/sessionsFiles/5009/HTA-F02-Detecting-and-Responding-to-Advanced-Threats-within-Exchange-Environments.pdf"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"[Threat Group-3390](https://attack.mitre.org/groups/G0027) actors look for and use VPN profiles during an operation to access the network using external VPN services.(Citation: Dell TG-3390) [Threat Group-3390](https://attack.mitre.org/groups/G0027) has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.(Citation: SecureWorks BRONZE UNION June 2017)","relationship_id":"relationship--ab6a19e4-ce00-46cd-ae83-0798471e4a4a","references":[{"source_name":"Dell TG-3390","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"SecureWorks BRONZE UNION June 2017","description":"Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.","url":"https://www.secureworks.com/research/bronze-union"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. [Sandworm Team](https://attack.mitre.org/groups/G0034) has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots June 2017)(Citation: ANSSI Sandworm January 2021)(Citation: mandiant_apt44_unearthing_sandworm)","relationship_id":"relationship--3d450e48-e73f-417f-941d-85c8658f5d1f","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"},{"source_name":"ESET BlackEnergy Jan 2016","description":"Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"},{"source_name":"ESET Telebots June 2017","description":"Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020.","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"},{"source_name":"mandiant_apt44_unearthing_sandworm","description":"Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.(Citation: US-CERT TA18-074A)(Citation: CISA AA20-296A Berserk Bear December 2020)","relationship_id":"relationship--cc6b3d5d-f77d-4c83-b484-1f2516133950","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source_name":"CISA AA20-296A Berserk Bear December 2020","description":"CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) uses remote services such as VPN, Citrix, or OWA to persist in an environment.(Citation: FireEye APT34 Webinar Dec 2017)","relationship_id":"relationship--55e34506-746d-4895-928b-72c2e358161d","references":[{"source_name":"FireEye APT34 Webinar Dec 2017","description":"Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}]},{"id":"G0053","name":"FIN5","url":"https://attack.mitre.org/groups/G0053","kind":"intrusion-set","description":"[FIN5](https://attack.mitre.org/groups/G0053) has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.(Citation: FireEye Respond Webinar July 2017)(Citation: DarkReading FireEye FIN5 Oct 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)","relationship_id":"relationship--9abd0448-a3b7-4262-8753-fe81dc91c434","references":[{"source_name":"Mandiant FIN5 GrrCON Oct 2016","description":"Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"},{"source_name":"DarkReading FireEye FIN5 Oct 2015","description":"Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017.","url":"https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?"},{"source_name":"FireEye Respond Webinar July 2017","description":"Scavella, T. and Rifki, A. (2017, July 20). Are you Ready to Respond? (Webinar). Retrieved October 4, 2017.","url":"https://web.archive.org/web/20190304204552/https://www2.fireeye.com/WBNR-Are-you-ready-to-respond.html"}]},{"id":"G0065","name":"Leviathan","url":"https://attack.mitre.org/groups/G0065","kind":"intrusion-set","description":"[Leviathan](https://attack.mitre.org/groups/G0065) has used external remote services such as virtual private networks (VPN) to gain initial access.(Citation: CISA AA21-200A APT40 July 2021)","relationship_id":"relationship--fa6bb182-28e8-4293-90ba-ee9a5c23d45b","references":[{"source_name":"CISA AA21-200A APT40 July 2021","description":"CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"id":"G0093","name":"GALLIUM","url":"https://attack.mitre.org/groups/G0093","kind":"intrusion-set","description":"[GALLIUM](https://attack.mitre.org/groups/G0093) has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)","relationship_id":"relationship--57b4f42b-02e2-4cee-98f0-d6935c1e2c7b","references":[{"source_name":"Cybereason Soft Cell June 2019","description":"Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source_name":"Microsoft GALLIUM December 2019","description":"MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used RDP to establish persistence.(Citation: CISA AA20-301A Kimsuky)","relationship_id":"relationship--9655304e-7bdb-4375-8789-2bfecc5b0a64","references":[{"source_name":"CISA AA20-301A Kimsuky","description":"CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.(Citation: FireEye APT41 Aug 2019)\n","relationship_id":"relationship--556f8dd8-50e0-4115-9815-c20bfc2b915a","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"G0099","name":"APT-C-36","url":"https://attack.mitre.org/groups/G0099","kind":"intrusion-set","description":"[APT-C-36](https://attack.mitre.org/groups/G0099) has used VPNs in their operational infrastructure.(Citation: Recorded Future TAG-144 AUG 2025)","relationship_id":"relationship--bd590dd0-7fec-4526-96f1-96a91ca15954","references":[{"source_name":"Recorded Future TAG-144 AUG 2025","description":"Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.(Citation: FireEye KEGTAP SINGLEMALT October 2020)","relationship_id":"relationship--79b0a6bc-4061-468c-ac1b-eef3dc3fb419","references":[{"source_name":"FireEye KEGTAP SINGLEMALT October 2020","description":"Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--bd8a36f5-1da5-49de-b292-ac0e4a58340c","references":[{"source_name":"Cycraft Chimera April 2020","description":"Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020..","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0115","name":"GOLD SOUTHFIELD","url":"https://attack.mitre.org/groups/G0115","kind":"intrusion-set","description":"[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.(Citation: Secureworks REvil September 2019)\t","relationship_id":"relationship--bc7f00a2-ba1c-428a-ba8f-174703389c73","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.(Citation: Intezer TeamTNT September 2020)(Citation: Cisco Talos Intelligence Group) [TeamTNT](https://attack.mitre.org/groups/G0139) has also targeted exposed kubelets for Kubernetes environments.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--01bebfd2-6c8c-4671-8754-34ca03c44299","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"},{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source_name":"Intezer TeamTNT September 2020","description":"Fishbein, N. (2020, September 8). Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks. Retrieved September 22, 2021.","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) have used VPNs both for initial access to victim environments and for persistence within them following compromise.(Citation: CISA GRU29155 2024)","relationship_id":"relationship--3ac252c3-1505-4bbe-9093-de7f9ef3f7b5","references":[{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix. (Citation: MSTIC DEV-0537 Mar 2022)(Citation: NCC Group LAPSUS Apr 2022)","relationship_id":"relationship--55af723a-6ca6-449d-be8e-d61a067fbefd","references":[{"source_name":"NCC Group LAPSUS Apr 2022","description":"Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022.","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source_name":"MSTIC DEV-0537 Mar 2022","description":"MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has leveraged legitimate remote management tools to maintain persistent access.(Citation: CrowdStrike Scattered Spider BYOVD January 2023)","relationship_id":"relationship--4f7a6812-5026-47ce-9424-e6658cec5e54","references":[{"source_name":"CrowdStrike Scattered Spider BYOVD January 2023","description":"CrowdStrike. (2023, January 10). SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security. Retrieved July 5, 2023.","url":"https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has gained access to compromised environments via remote access services such as the corporate virtual private network (VPN).(Citation: Mandiant FIN13 Aug 2022)","relationship_id":"relationship--10c4c857-59e6-4168-b2af-96b6609bdc76","references":[{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used VPNs to connect to victim environments and enable post-exploitation actions.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--419745f1-4065-4aad-bf90-ffe198562bd8","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1024","name":"Akira","url":"https://attack.mitre.org/groups/G1024","kind":"intrusion-set","description":"[Akira](https://attack.mitre.org/groups/G1024) uses compromised VPN accounts for initial access to victim networks.(Citation: Secureworks GOLD SAHARA)","relationship_id":"relationship--d2825a04-d5c4-4598-aa3d-cb72cfe74ac4","references":[{"source_name":"Secureworks GOLD SAHARA","description":"Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024.","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"}]},{"id":"G1040","name":"Play","url":"https://attack.mitre.org/groups/G1040","kind":"intrusion-set","description":"\n[Play](https://attack.mitre.org/groups/G1040) has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--d92510c1-43d7-4b4c-b3a1-cf7ae0387737","references":[{"source_name":"CISA Play Ransomware Advisory December 2023","description":"CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"G1041","name":"Sea Turtle","url":"https://attack.mitre.org/groups/G1041","kind":"intrusion-set","description":"[Sea Turtle](https://attack.mitre.org/groups/G1041) has used external-facing SSH to achieve initial access to the IT environments of victim organizations.(Citation: Hunt Sea Turtle 2024)","relationship_id":"relationship--ad5cf8f1-5915-41e2-87d5-a06ac1e6b3b6","references":[{"source_name":"Hunt Sea Turtle 2024","description":"Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"id":"G1047","name":"Velvet Ant","url":"https://attack.mitre.org/groups/G1047","kind":"intrusion-set","description":"[Velvet Ant](https://attack.mitre.org/groups/G1047) has leveraged access to internet-facing remote services to compromise and retain access to victim environments.(Citation: Sygnia VelvetAnt 2024A)","relationship_id":"relationship--48611952-483d-4469-a3f1-745b40207055","references":[{"source_name":"Sygnia VelvetAnt 2024A","description":"Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has leveraged public facing VPN infrastructure to gain initial access to victim environments.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)","relationship_id":"relationship--b0c5bff6-44da-421f-adf4-d9b3c8746693","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","description":"Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]}],"mitigations":[{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"Restrict all traffic to and from public Tor nodes. (Citation: Defending Against Malicious Cyber Activity Originating from Tor)","relationship_id":"relationship--7302a389-7e1e-43b6-8b04-88ab89f17470","references":[{"source_name":"Defending Against Malicious Cyber Activity Originating from Tor","description":"CISA, FBI. (2020, July 1). Defending Against Malicious Cyber Activity Originating from Tor . Retrieved June 20, 2025.","url":"https://www.cisa.gov/sites/default/files/publications/AA20-183A_Defending_Against_Malicious_Cyber_Activity_Originating_from_Tor_S508C.pdf"}]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.","relationship_id":"relationship--8df2f4b5-3f60-4b8f-b4aa-dd76eb347ab0","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of [Multi-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111) techniques for some two-factor authentication implementations.","relationship_id":"relationship--e23d57b4-5bc4-4d06-9084-9c99464c4af8","references":[]},{"id":"M1035","name":"Limit Access to Resource Over Network","url":"https://attack.mitre.org/mitigations/M1035","kind":"course-of-action","description":"Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.","relationship_id":"relationship--9eaaffb7-4dc4-4aac-a1d5-675b71e587df","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Disable or block remotely available services that may be unnecessary.","relationship_id":"relationship--9aaf5e70-4080-4f73-8d6d-3b19f754e9b9","references":[]}],"candidates":[{"id":"4c8db261-a58b-42a6-a866-0a294deedde4","name":"Running Chrome VPN Extensions via the Registry 2 vpn extension","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1133/T1133.yaml","description":"Running Chrome VPN Extensions via the Registry install 2 vpn extension, please see \"T1133\\src\\list of vpn extension.txt\" to view complete list\n","inputs":{"chrome_url":{"description":"chrome installer download URL","type":"url","default":"https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BFD62DDBC-14C6-20BD-706F-C7744738E422%7D%26lang%3Den%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1%26installdataindex%3Dempty/chrome/install/ChromeStandaloneSetup64.exe"},"extension_id":{"description":"chrome extension id","type":"string","default":"\"fcfhplploccackoneaefokcmbjfbkenj\", \"fdcgdnkidjaadafnichfpabhfomcebme\"\n"}},"dependencies":[{"description":"Chrome must be installed\n"}],"source_definition_sha256":"1e3ac4f10b669ff28ca25e8878f1b666394e54dd8038ae7bcb15aa8fc4d8e8f3"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1021.006":"/ttp-simulation/techniques/enterprise/T1021.006/","T1021.005":"/ttp-simulation/techniques/enterprise/T1021.005/","T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1133":"/ttp-simulation/techniques/enterprise/T1133/","T1111":"/ttp-simulation/techniques/enterprise/T1111/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1133","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}