T1210 Exploitation of Remote Services — Detection Rules

Source-backed rule directory

• Apache Threading Error · test · medium · {"service":"apache","definition":"Requirements: Must be able to collect the error.log file"}
• Audit CVE Event · test · critical · {"product":"windows","service":"application"}
• Zerologon Exploitation Using Well-known Tools · stable · critical · {"service":"system","product":"windows"}
• DNS Query Request By QuickAssist.EXE · experimental · low · {"category":"dns_query","product":"windows"}
• HackTool - SharpWSUS/WSUSpendu Execution · test · high · {"product":"windows","category":"process_creation"}
• Suspicious SysAidServer Child · test · medium · {"category":"process_creation","product":"windows"}
• Terminal Service Process Spawn · test · high · {"product":"windows","category":"process_creation"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0118 Exploitation of Remote Services – multi-platform lateral movement detection

AN0327 Analytic 0327

Correlates inbound network access to remote service ports (e.g., SMB/RPC 445/135, RDP 3389, WinRM 5985/5986) with near-time instability in the target service (crash, abnormal restart), suspicious child process creation under the service, and post-access lateral-movement behaviors. The chain indicates likely exploitation rather than normal administration.

AN0328 Analytic 0328

Links inbound network access to SSHD/SMB/NFS/Databases or custom daemons with subsequent daemon crash/restart, core dump, or spawning of shells/reverse shells from the service context, indicating remote exploitation.

AN0329 Analytic 0329

Detects exploitation targeting ESXi/vCenter by correlating attempts to reach known exploitable endpoints (OpenSLP 427, CIM 5989, Hostd/Vpxa HTTPS 443, ESXi SOAP) with vmkernel/hostd crashes, unexpected hostd/vpxa restarts, or new reverse/outbound connections from ESXi host/vCenter to internal assets.

AN0330 Analytic 0330

Ties inbound access to exposed services (ARD/VNC 5900, SSH 22, ScreenSharing, web services) with process crashes in unified logs and abnormal child processes spawned under those services (e.g., bash, curl) to indicate exploitation.