Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1021_remote-services
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC.
Passed 20 of 24 test cases with the skill, and 12 of 24 without it.
and 5 more in the full report
8 fixed13 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
In our executive risk summary for technique T1021, we need to complete the standard risk assessment finding table entry. What are the specific Severity and Impact field values assigned when the Remote Services technique is applicable?
| Checked | Without skill | With skill |
|---|---|---|
| Sets the Risk Assessment Severity field to High. | Passed | Passed |
| Sets the Risk Assessment Impact field to Lateral Movement. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter.
Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.
Platforms: Linux, macOS, Windows, IaaS, ESXi
Identify Attack Surface: Determine if the target environment is susceptible to Remote Services by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1021 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 24 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.