Dark Mode
Capec-555 Detail
Remote Services with Stolen Credentials
Standard Software Typical Severity: Very High
Parents: 560
Threats: T71 T75 T263 T271 T279 T283 T292 T307 T385 T388 T398 T402
This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-555 | capec | https://capec.mitre.org/data/definitions/555.html | |
| CWE-522 | cwe | http://cwe.mitre.org/data/definitions/522.html | |
| CWE-308 | cwe | http://cwe.mitre.org/data/definitions/308.html | |
| CWE-309 | cwe | http://cwe.mitre.org/data/definitions/309.html | |
| CWE-294 | cwe | http://cwe.mitre.org/data/definitions/294.html | |
| CWE-263 | cwe | http://cwe.mitre.org/data/definitions/263.html | |
| CWE-262 | cwe | http://cwe.mitre.org/data/definitions/262.html | |
| CWE-521 | cwe | http://cwe.mitre.org/data/definitions/521.html | |
| T1021 | ATTACK | https://attack.mitre.org/wiki/Technique/T1021 | Remote Services |
| T1114.002 | ATTACK | https://attack.mitre.org/wiki/Technique/T1114/002 | Email Collection:Remote Email Collection |
| T1133 | ATTACK | https://attack.mitre.org/wiki/Technique/T1133 | External Remote Services |
Not present
Not present
Not present
Not present
Not present
- Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). There are other implementations and third-party tools that provide graphical access Remote Services similar to RDS. Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.
- Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell.