CAPEC-555: Remote Services with Stolen Credentials
Description
This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Very High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Subvert Access Control
Mitigations
- Disable RDP, telnet, SSH and enable firewall rules to block such traffic. Limit users and accounts that have remote interactive login access. Remove the Local Administrators group from the list of groups allowed to login through RDP. Limit remote user permissions. Use remote desktop gateways and multifactor authentication for remote logins.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 3 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-STSession Termination2 shared
- D3-ACHApplication Configuration Hardening1 shared
- D3-DRADisable Remote Access1 shared
- D3-EFEmail Filtering1 shared
- D3-RERestore Email1 shared
- D3-RNARestore Network Access1 shared
- D3-SMRASender MTA Reputation Analysis1 shared
- D3-SRASender Reputation Analysis1 shared
- D3-EREmail Removal1 shared
- D3-EHBEndpoint Health Beacon1 shared
- D3-LLMLogical Link Mapping1 shared
- D3-NNINetwork Node Inventory1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-07-002RDP Connection Detection1 shared
- CAR-2014-05-001RPC Activity1 shared
- CAR-2014-11-006Windows Remote Management (WinRM)1 shared
- CAR-2016-04-005Remote Desktop Logon1 shared
- CAR-2013-01-003SMB Events Monitoring1 shared
- CAR-2013-10-001User Login Activity Monitoring1 shared
- CAR-2014-11-004Remote PowerShell Sessions1 shared
- CAR-2013-05-003SMB Write Request1 shared
- CAR-2013-05-005SMB Copy and Execution1 shared
- CAR-2013-07-001Suspicious Arguments1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared