T1133 — External Remote Services

Tactics: Persistence, Initial Access · Platforms: Containers, Linux, macOS, Windows

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service…

Sigma detection rules (4)

T1133 External Remote Services

title: T1133 External Remote Services
id: 61f815c2-68a7-4245-af0e-ca5e4255eea1
description: 'Detects successful (4624) and failed (4625) Windows logons with LogonType 10 (RemoteInteractive/RDP), the primary Windows-observable proxy for use of external-facing remote access services such as RDP, RDS gateways, or RDP-fronted VPN/Citrix access. Tune using: BusinessHours, KnownRemoteIPs, FailedLogonThreshold, GeoIPWhitelist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1133
author: Shahrukh Khan
date: 2026-06-26
license: MIT
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID:
      - 4624
      - 4625
    LogonType: 10

  filter_system_account:
    TargetUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) are excluded via filter_system_account; legitimate remote administrators, contractors, or VPN/RDP users connecting from external networks still generate LogonType 10 events, so tune further with KnownRemoteIPs/GeoIPWhitelist and business-hours windows.

level: medium

T1133 External Remote Services

title: T1133 External Remote Services
id: 60a3e3bf-1ffe-40df-9e7d-919e9c1ed27b
description: 'Detects successful authentications via the SSH daemon from non-loopback source addresses, the auditd-visible proxy for use of an external-facing remote-access service. (Retargeted from a tautological bare USER_LOGIN-success match to constrain on the remote-service daemon and exclude local-only logins.) Tune using: KnownSSHClients, TrustedSourceCIDRs.'
references:
  - https://attack.mitre.org/techniques/T1133
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133

logsource:
  product: linux
  service: auditd

detection:
  selection:
    type: USER_LOGIN
    res: success
    exe|contains: '/sshd'
  filter_local:
    addr:
      - '127.0.0.1'
      - '::1'
      - 'localhost'

  condition: selection and not filter_local

falsepositives:
  - Legitimate remote administration and authorized remote-work SSH sessions create identical successful-login records; requires KnownSSHClients/TrustedSourceCIDRs tuning to separate sanctioned remote access from abuse of an externally exposed service.

level: low

T1133 External Remote Services

title: T1133 External Remote Services
id: e4563ae3-bcdf-4698-90af-429948f2d243
description: 'Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: KnownVNCServers, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1133
author: Shahrukh Khan
date: 2026-05-04
license: MIT
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    DestinationPort:
      - 5900
      - 3389

  condition: selection

falsepositives:
  - Legitimate remote-support sessions using Screen Sharing (VNC) or RDP clients to reach managed servers.

level: medium

T1133 External Remote Services

title: T1133 External Remote Services
id: 5a2401e1-84ae-4aa4-ae01-3c3f5ebfe3cf
description: 'Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: AllowedCIDRs, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1133
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133

logsource:
  product: applicationlog
  service: api

detection:
  selection:
    requestURI|contains:
      - '/containers/'
      - '/exec'
      - '/api/v1/'
  filter_internal:
    sourceIP|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'

  condition: selection and not filter_internal

falsepositives:
  - External CI/CD runners, cloud load balancers, or monitoring services that legitimately reach the orchestrator API over public addresses.

level: medium

Explore