Remote Services
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain c...
BY SOURCE
PROCEDURES (54)
Auto-extracted: 9 detections for remote
Auto-extracted: 6 detections for unusual
Auto-extracted: 6 detections for lateral
Auto-extracted: 4 detections for registry
Auto-extracted: 4 detections for service
Auto-extracted: 3 detections for network connection monitoring
Auto-extracted: 3 detections for exfiltrat
Auto-extracted: 3 detections for authentication monitoring
Auto-extracted: 3 detections for service
Auto-extracted: 2 detections for dump
Auto-extracted: 2 detections for tunnel
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for kubernetes
Auto-extracted: 2 detections for ransomware
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for process creation monitoring
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for scheduled task
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for unusual
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for exfiltrat