T1210 — Exploitation of Remote Services

Tactic: Lateral Movement · Platforms: Linux, Windows, macOS, ESXi

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself…

Sigma detection rules (4)

T1210 Exploitation of Remote Services

title: T1210 Exploitation of Remote Services
id: e4ddeaf3-3797-4fcd-9373-3f1c246f3518
description: 'Detects potential exploitation of a remote network-facing service via a service host process (web server, database engine, RDP/SMB/WMI service host) spawning an unexpected shell or LOLBin child process, indicating likely remote code execution. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ServiceHostImageList, ShellImageList, AllowedAdminAccounts, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1210
author: Shahrukh Khan
date: 2026-04-16
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1210

logsource:
  category: process_creation
  product: windows

detection:
  selection_service_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\sqlservr.exe'
      - '\vmwp.exe'
      - '\wmiprvse.exe'
      - '\spoolsv.exe'
  selection_shell_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'

  condition: selection_service_parent and selection_shell_child

falsepositives:
  - Legitimate administrative scripts or maintenance automation launched by web/database/print-spooler service processes; vendor management agents that spawn shells for health checks.

level: high

T1210 Exploitation of Remote Services

title: T1210 Exploitation of Remote Services
id: 845fa95c-518a-4d0c-9fbb-0c9e26ceaad6
description: 'Exploitation of Remote Services – multi-platform lateral movement detection. (Retargeted: systemctl restart events and bare systemd-coredump crashes are routine administration/crash-handling noise with no tie to a network-facing service being exploited; this version instead looks for a shell being spawned with no associated login session (auid unset, i.e. 4294967295) running under a network-facing service account -- the classic auditd-observable fingerprint of a daemon such as mysqld/httpd/smbd being exploited into executing a command shell. A definitive link to a specific vulnerable service/CVE still requires correlation with service logs auditd does not produce.) Tune using: ServiceAccountNames, ShellSpawnAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1210
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1210

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_shell_exec:
    type: EXECVE
    a0|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
  selection_service_account:
    uid:
      - 'mysql'
      - 'www-data'
      - 'apache'
      - 'nobody'
      - 'postgres'
      - 'nginx'
  selection_no_login_session:
    auid: '4294967295'

  condition: selection_shell_exec and selection_service_account and selection_no_login_session

falsepositives:
  - Service accounts that legitimately invoke a shell as part of cron jobs, health-check scripts, or container entrypoints; allowlist known ShellSpawnAllowlist commands and scope ServiceAccountNames to genuinely network-facing daemons only.

level: medium

T1210 Exploitation of Remote Services

title: T1210 Exploitation of Remote Services
id: c7f4dbe3-8862-4c18-9f3d-ee72fe50ffdb
description: 'Exploitation of Remote Services – multi-platform lateral movement detection. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ServicePortSet, AllowedAdmins, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1210
author: Shahrukh Khan
date: 2026-01-02
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1210

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/ssh'
      - '/smbutil'
      - '/afpfsck'
  selection_admin:
    User|contains: 'root'
  condition: selection and selection_admin

falsepositives:
  - Administrators regularly use ssh and smbutil to manage remote macOS hosts and file shares, so this pattern alone cannot distinguish legitimate remote administration from exploitation of a vulnerable remote service without correlated crash or vulnerability signal.

level: medium

T1210 Exploitation of Remote Services

title: T1210 Exploitation of Remote Services
id: 67e3dd97-fd4b-474d-b9ef-085a1303a2d1
description: 'Exploitation of Remote Services – multi-platform lateral movement detection. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ESXiServicePorts, MgmtCIDRs, RestartKeywords.'
references:
  - https://attack.mitre.org/techniques/T1210
author: Shahrukh Khan
date: 2026-01-13
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1210

logsource:
  product: esxi
  service: vobd

detection:
  selection_service:
    Message|contains:
      - 'slpd'
      - 'sfcbd'
      - 'hostd'
  selection_event:
    Message|contains:
      - 'restart'
      - 'crash'
      - 'core dump'
      - 'not responding'

  condition: selection_service and selection_event

falsepositives:
  - Legitimate service restarts during patching or an ESXi reboot; distinguishing an OpenSLP or CIM broker exploitation attempt (for example CVE-2019-5544 or CVE-2019-5528 style abuse) from routine instability requires correlating this with unexpected timing or a subsequent unauthorized session.

level: critical

Explore