T1210 Exploitation of Remote Services — Attack Simulation

DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: service, action, actor, record_count, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0038",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "lab-portal",
    "action": "export_requested",
    "actor": "lab-reader",
    "record_count": 3,
    "result": "authorized"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, path, action, size_bytes.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0039",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "path": "C:\\Lab\\demo.txt",
    "action": "create",
    "size_bytes": 64
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0016 collection page — Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, image_loaded, signed, action.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0016",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image_loaded": "C:\\Lab\\demo.dll",
    "signed": false,
    "action": "load"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0035 collection page — Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: source_process_id, target_process_id, granted_access, action.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0035",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_process_id": 4200,
    "target_process_id": 4300,
    "granted_access": "0x1000",
    "action": "open_process"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

MITRE detection strategy

7 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Apache Threading Error — test; service: apache; definition: Requirements: Must be able to collect the error.log file.
• Audit CVE Event — test; product: windows; service: application.
• Zerologon Exploitation Using Well-known Tools — stable; service: system; product: windows.
• DNS Query Request By QuickAssist.EXE — experimental; category: dns_query; product: windows.
• HackTool - SharpWSUS/WSUSpendu Execution — test; product: windows; category: process_creation.
• Suspicious SysAidServer Child — test; category: process_creation; product: windows.
• Terminal Service Process Spawn — test; product: windows; category: process_creation.

• S0143 Flame — malware.

  Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.[Kaspersky Flame][Kaspersky Flame Functionality]

  Exact relationship: relationship--052b685c-6d95-4a98-86f1-4c9bb39a398c
• S0260 InvisiMole — malware.

  InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.[ESET InvisiMole June 2020]

  Exact relationship: relationship--a14c0cae-f7da-42d6-ab3c-f11746233e06
• S0266 TrickBot — malware.

  TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.[ESET Trickbot Oct 2020]

  Exact relationship: relationship--e56f602c-ec9f-46f0-a52f-45b90220314e
• S0363 Empire — tool.

  Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.[Github PowerShell Empire]

  Exact relationship: relationship--73fbf268-20d3-4549-9dd2-6e20e18079e0
• S0366 WannaCry — malware.

  WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.[LogRhythm WannaCry][FireEye WannaCry 2017][US-CERT WannaCry 2017]

  Exact relationship: relationship--0e12dc13-6f73-4ad9-9cb5-845d443b4d58
• S0367 Emotet — malware.

  Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.[Symantec Emotet Jul 2018][US-CERT Emotet Jul 2018][Secureworks Emotet Nov 2018][Red Canary Emotet Feb 2019]

  Exact relationship: relationship--6cb2f741-eedb-4b1d-8d84-7823f0095d44
• S0368 NotPetya — malware.

  NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.[Talos Nyetya June 2017][US-CERT NotPetya 2017][US District Court Indictment GRU Unit 74455 October 2020]

  Exact relationship: relationship--771b78fb-4ed1-4c55-b5e8-31775eb60ad2
• S0378 PoshC2 — tool.

  PoshC2 contains a module for exploiting SMB via EternalBlue.[GitHub PoshC2]

  Exact relationship: relationship--bd1282fe-7a81-432b-9ac7-f93fb8f8b33f
• S0532 Lucifer — malware.

  Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).[Unit 42 Lucifer June 2020]

  Exact relationship: relationship--c1a8eea8-f273-4dad-8ae0-d5c93bf5467f
• S0603 Stuxnet — malware.

  Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]

  Exact relationship: relationship--4f2bd19b-f0f4-4946-a7a5-4947be3346b1
• S0606 Bad Rabbit — malware.

  Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.[Secure List Bad Rabbit]

  Exact relationship: relationship--754d1521-2fcf-4511-b7df-af4fffc7d635
• S0608 Conficker — malware.

  Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.[SANS Conficker]

  Exact relationship: relationship--b56b122d-0a12-4b1a-854e-5c0826603121
• S0650 QakBot — malware.

  QakBot can move laterally using worm-like functionality through exploitation of SMB.[Crowdstrike Qakbot October 2020]

  Exact relationship: relationship--670efee1-b854-4d39-85b1-b6038e3580e3

• M1016 Vulnerability Scanning

  Regularly scan the internal network for available services to identify new and potentially vulnerable services.

• M1019 Threat Intelligence Program

  Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.

• M1026 Privileged Account Management

  Minimize permissions and access for service accounts to limit impact of exploitation.

• M1030 Network Segmentation

  Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods.

• M1042 Disable or Remove Feature or Program

  Minimize available services to only those that are necessary.

• M1048 Application Isolation and Sandboxing

  Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist. [Ars Technica Pwn2Own 2017 VM Escape]

• M1050 Exploit Protection

  Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. [TechNet Moving Beyond EMET] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. [Wikipedia Control Flow Integrity] Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted.

• M1051 Update Software

  Update software regularly by employing patch management for internal enterprise endpoints and servers.