Detecting and Mitigating External Remote Services Abuse (T1133)

Remote access is a business need. VPNs, Citrix and similar gateways let people reach internal systems from outside. T1133, External Remote Services, is what happens when an adversary uses those same doors, either to get in or to stay in.

MITRE lists two tactics, persistence and initial access, and four platforms: Containers, Linux, macOS and Windows.

How attackers use it

The common thread is a service that faces the internet and lets someone through.

• Gateways and remote tools. VPNs, Citrix and other access mechanisms are fronted by gateways that manage connections and credential authentication. Services such as Windows Remote Management and VNC can also be used externally.
• Valid accounts. Using the service usually needs a working account. MITRE says these may be obtained through credential pharming, or from users after the enterprise network is compromised. Access can then serve as a redundant or persistent way back in.
• No authentication at all. A service may be exposed without requiring authentication. In containerized environments MITRE names an exposed Docker API, Kubernetes API server, kubelet, or a web app such as the Kubernetes dashboard.
• Tor hidden services. An adversary can persist by configuring a Tor hidden service on a compromised system. MITRE names a tool called ShadowLink that sets up a .onion address, can forward inbound connections to RDP, and can persist by masquerading as a Microsoft Defender application.

The MITRE page lists a long run of groups that have used this technique, including Akira and Scattered Spider.

How to detect it

MITRE's detection strategy is a behavior chain with a variant per platform.

• Windows, general. Unusual or unauthorized external remote access attempts such as RDP, VPN or Citrix. Look for repeated failed logins followed by a success from an uncommon location or outside business hours, then internal lateral movement or data exfiltration.
• Linux. Repeated SSH, VPN or RDP gateway authentication attempts from external IPs, then a successful logon and a remote shell or lateral movement such as scp or sftp.
• macOS. Unexpected inbound or outbound VNC, SSH or Screen Sharing connections from external sources, repeated failures then success, then remote interactive sessions or abnormal file transfers.
• Containers. Connections to exposed container services, such as the Docker API or the Kubernetes API server, from unauthorized external IPs, then abnormal container creation or start and lateral activity across cluster nodes.

The shape to remember is fail, fail, success, then lateral movement. Put VPN and gateway logs next to your internal authentication logs so one account's story is in one place.

How to reduce the risk

MITRE lists five mitigations.

1. Use multi-factor authentication for remote service accounts, so stolen credentials alone are not enough. MITRE adds a caution that some MFA implementations can be intercepted (technique T1111), so choose carefully.
2. Limit access through managed concentrators, such as VPNs and other managed remote access systems, instead of many separate doors.
3. Segment the network. Deny direct remote access to internal systems and force it through proxies, gateways and firewalls.
4. Disable services you do not need. Disable or block remotely available services that are unnecessary.
5. Restrict Tor. Block all traffic to and from public Tor nodes.

Check your own environment

Start by listing what listens on each host, then compare to what you meant to expose.

Linux:

ss -tlnp

Windows (PowerShell):

Get-NetTCPConnection -State Listen | Sort-Object LocalPort

For containers, look for the Docker API on its well-known ports, 2375 (plain) and 2376 (TLS), and for the kubelet on 10250:

ss -tlnp | grep -E ':2375|:2376|:10250'

Anything bound to all interfaces that is reachable from the internet needs an owner and a reason. Then review gateway logs for the fail-then-succeed pattern above.

Try it yourself

You cannot protect a door you do not know exists. This demo walks through asset discovery.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• MITRE ATT&CK, T1133 External Remote Services